Commit 7ac97fc

Browse files
npm-cli-botaduh95
npm-cli-bot
authored and
aduh95
committed
deps: upgrade npm to 11.18.0
PR-URL: #64199 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Richard Lau <richard.lau@ibm.com>
1 parent 2ef4b7e commit 7ac97fc

293 files changed

Lines changed: 3844 additions & 723 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/npm/docs/content/commands/npm-approve-scripts.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ the command cannot infer. Existing `false` entries always win;
5959
`approve-scripts` will not silently re-allow a package you previously
6060
denied.
6161

62+
If a registry dependency has no `resolved` URL in your `package-lock.json`
63+
(for example, an older lockfile or one written with
64+
`omit-lockfile-registry-resolved`), npm cannot verify a trusted version for
65+
it and cannot pin it: a `pkg@1.2.3` entry never matches, so the package
66+
keeps appearing under `--allow-scripts-pending`. `approve-scripts` approves
67+
these by name (`pkg: true`) and warns when it does. To restore pinning,
68+
refresh the lockfile with `npm install`.
69+
6270
### Examples
6371

6472
```bash

‎deps/npm/docs/content/commands/npm-ci.md‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987

8088

8189

@@ -298,6 +306,10 @@ silently skipped; this setting only affects unreviewed entries.
298306
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
299307
setting.
300308

309+
Optional dependencies that cannot be installed on the current platform or
310+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
311+
their install scripts never run.
312+
301313

302314

303315
#### `dangerously-allow-all-scripts`

‎deps/npm/docs/content/commands/npm-dedupe.md‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987
8088
8189

‎deps/npm/docs/content/commands/npm-exec.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,10 @@ silently skipped; this setting only affects unreviewed entries.
194194
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
195195
setting.
196196

197+
Optional dependencies that cannot be installed on the current platform or
198+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
199+
their install scripts never run.
200+
197201

198202

199203
#### `dangerously-allow-all-scripts`

‎deps/npm/docs/content/commands/npm-find-dupes.md‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2525
(default): Install non-duplicated in top-level, and duplicated as necessary
2626
within directory structure. nested: (formerly --legacy-bundling) install in
2727
place, no hoisting. shallow (formerly --global-style) only install direct
28-
deps at top-level. linked: (experimental) install in node_modules/.store,
29-
link in place, unhoisted.
28+
deps at top-level. linked: install in node_modules/.store, link in place,
29+
unhoisted.
30+
31+
We recommend that package authors use `--install-strategy=linked` during
32+
development to catch undeclared ("phantom") dependencies before publishing:
33+
the isolated layout only exposes a package's declared dependencies, so an
34+
`import` of a package that was never added to `package.json` can fail
35+
instead of resolving by accident and shipping broken. See [Catching
36+
undeclared ("phantom")
37+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3038

3139

3240

‎deps/npm/docs/content/commands/npm-install-ci-test.md‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2727
(default): Install non-duplicated in top-level, and duplicated as necessary
2828
within directory structure. nested: (formerly --legacy-bundling) install in
2929
place, no hoisting. shallow (formerly --global-style) only install direct
30-
deps at top-level. linked: (experimental) install in node_modules/.store,
31-
link in place, unhoisted.
30+
deps at top-level. linked: install in node_modules/.store, link in place,
31+
unhoisted.
32+
33+
We recommend that package authors use `--install-strategy=linked` during
34+
development to catch undeclared ("phantom") dependencies before publishing:
35+
the isolated layout only exposes a package's declared dependencies, so an
36+
`import` of a package that was never added to `package.json` can fail
37+
instead of resolving by accident and shipping broken. See [Catching
38+
undeclared ("phantom")
39+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3240

3341

3442

@@ -251,6 +259,10 @@ silently skipped; this setting only affects unreviewed entries.
251259
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
252260
setting.
253261

262+
Optional dependencies that cannot be installed on the current platform or
263+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
264+
their install scripts never run.
265+
254266

255267

256268
#### `dangerously-allow-all-scripts`

‎deps/npm/docs/content/commands/npm-install-scripts.md‎

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
---
2+
title: npm-install-scripts
3+
section: 1
4+
description: Manage install-script approvals for dependencies
5+
---
6+
7+
### Synopsis
8+
9+
```bash
10+
npm install-scripts approve <pkg> [<pkg> ...]
11+
npm install-scripts approve --all
12+
npm install-scripts deny <pkg> [<pkg> ...]
13+
npm install-scripts deny --all
14+
npm install-scripts ls
15+
npm install-scripts prune
16+
```
17+
18+
Note: This command is unaware of workspaces.
19+
20+
### Description
21+
22+
Manages the `allowScripts` field in your project's `package.json`, which
23+
records which of your dependencies are permitted to run install scripts
24+
(`preinstall`, `install`, `postinstall`, and `prepare` for non-registry
25+
sources). This is the recommended way to maintain that field.
26+
27+
Dependency install scripts are blocked by default. Install commands
28+
silently skip lifecycle scripts for any dependency that does not have a
29+
matching entry in `allowScripts`, and end with a list of the packages
30+
whose scripts were skipped so you can review them here.
31+
32+
This command only works inside a project that has a `package.json`. Running
33+
it with `--global` (`-g`) fails with an `EGLOBAL` error, since global
34+
installs (`npm install -g`) and one-off executions (`npm exec` / `npx`) have
35+
no project `package.json` to write to. To allow install scripts in those
36+
contexts, use the `--allow-scripts` flag at install time (for example
37+
`npm install -g --allow-scripts=canvas,sharp`) or persist the setting with
38+
`npm config set allow-scripts=canvas,sharp --location=user`.
39+
40+
There are four subcommands:
41+
42+
```bash
43+
npm install-scripts approve <pkg> [<pkg> ...]
44+
npm install-scripts approve --all
45+
npm install-scripts deny <pkg> [<pkg> ...]
46+
npm install-scripts deny --all
47+
npm install-scripts ls
48+
npm install-scripts prune
49+
```
50+
51+
`approve` allows install scripts for the named packages. `<pkg>` matches
52+
every installed version of that package. By default it writes pinned entries
53+
(`pkg@1.2.3`), which keep their approval narrowed to the specific version you
54+
reviewed. Pass `--no-allow-scripts-pin` to write name-only entries that allow
55+
any future version. `--all` approves every package with unreviewed install
56+
scripts in one go.
57+
58+
`deny` records an explicit denial for the named packages (a name-only `false`
59+
entry), which survives `npm install-scripts approve --all` and excludes the
60+
package from any future blanket approval. `--all` denies every package with
61+
unreviewed install scripts.
62+
63+
`ls` is read-only: it lists every package whose install scripts are not yet
64+
covered by `allowScripts`, without modifying `package.json`.
65+
66+
`prune` removes `allowScripts` entries that no longer match an installed
67+
package with an install script, either because the package is no longer
68+
installed (a transitive dependency changed, or a pinned `pkg@1.2.3` was
69+
upgraded) or because it no longer has an install script. Both approvals
70+
(`true`) and denials (`false`) are removed. It edits only the `allowScripts`
71+
field in `package.json`, never `.npmrc` or `--allow-scripts`. Pass `--dry-run`
72+
to preview without writing. Unparseable keys are left alone.
73+
74+
`approve` honours the asymmetric pin rule: if you re-approve a package whose
75+
installed version has changed, the existing pin is rewritten to track the new
76+
installed version. Multi-version statements (`pkg@1 || 2`) are left alone,
77+
since they likely capture intent that the command cannot infer. Existing
78+
`false` entries always win; `approve` will not silently re-allow a package you
79+
previously denied.
80+
81+
The standalone commands [`npm approve-scripts`](/commands/npm-approve-scripts)
82+
and [`npm deny-scripts`](/commands/npm-deny-scripts) are aliases for
83+
`npm install-scripts approve` and `npm install-scripts deny`.
84+
85+
### Examples
86+
87+
```bash
88+
# Approve all currently-installed install scripts after reviewing them
89+
npm install-scripts approve --all
90+
91+
# Approve specific packages, pinned to their installed version
92+
npm install-scripts approve canvas sharp
93+
94+
# Deny a package so it stays blocked
95+
npm install-scripts deny telemetry-pkg
96+
97+
# Preview which packages still need review
98+
npm install-scripts ls
99+
100+
# Preview stale allowScripts entries, then remove them
101+
npm install-scripts prune --dry-run
102+
npm install-scripts prune
103+
```
104+
105+
### Configuration
106+
107+
#### `all`
108+
109+
* Default: false
110+
* Type: Boolean
111+
112+
Show or act on all packages, not just the ones your project directly depends
113+
on. For `npm outdated` and `npm ls` this lists every outdated or installed
114+
package. For `npm approve-scripts` and `npm deny-scripts` it selects every
115+
package with pending install scripts.
116+
117+
118+
119+
#### `allow-scripts-pin`
120+
121+
* Default: true
122+
* Type: Boolean
123+
124+
Write pinned (`pkg@version`) entries when approving install scripts. Set to
125+
`false` to write name-only entries that allow any version. Has no effect on
126+
`npm deny-scripts`, which always writes name-only entries regardless of this
127+
setting.
128+
129+
130+
131+
#### `dry-run`
132+
133+
* Default: false
134+
* Type: Boolean
135+
136+
Indicates that you don't want npm to make any changes and that it should
137+
only report what it would have done. This can be passed into any of the
138+
commands that modify your local installation, eg, `install`, `update`,
139+
`dedupe`, `uninstall`, as well as `pack` and `publish`.
140+
141+
Note: This is NOT honored by other network related commands, eg `dist-tags`,
142+
`owner`, etc.
143+
144+
145+
146+
#### `json`
147+
148+
* Default: false
149+
* Type: Boolean
150+
151+
Whether or not to output JSON data, rather than the normal output.
152+
153+
* In `npm pkg set` it enables parsing set values with JSON.parse() before
154+
saving them to your `package.json`.
155+
156+
Not supported by all npm commands.
157+
158+
159+
160+
### See Also
161+
162+
*[npm approve-scripts](/commands/npm-approve-scripts)
163+
*[npm deny-scripts](/commands/npm-deny-scripts)
164+
*[npm install](/commands/npm-install)
165+
*[npm rebuild](/commands/npm-rebuild)
166+
*[package.json](/configuring-npm/package-json)

‎deps/npm/docs/content/commands/npm-install-test.md‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,16 @@ Sets the strategy for installing packages in node_modules. hoisted
6868
(default): Install non-duplicated in top-level, and duplicated as necessary
6969
within directory structure. nested: (formerly --legacy-bundling) install in
7070
place, no hoisting. shallow (formerly --global-style) only install direct
71-
deps at top-level. linked: (experimental) install in node_modules/.store,
72-
link in place, unhoisted.
71+
deps at top-level. linked: install in node_modules/.store, link in place,
72+
unhoisted.
73+
74+
We recommend that package authors use `--install-strategy=linked` during
75+
development to catch undeclared ("phantom") dependencies before publishing:
76+
the isolated layout only exposes a package's declared dependencies, so an
77+
`import` of a package that was never added to `package.json` can fail
78+
instead of resolving by accident and shipping broken. See [Catching
79+
undeclared ("phantom")
80+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7381

7482

7583

@@ -328,6 +336,10 @@ silently skipped; this setting only affects unreviewed entries.
328336
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
329337
setting.
330338

339+
Optional dependencies that cannot be installed on the current platform or
340+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
341+
their install scripts never run.
342+
331343

332344

333345
#### `dangerously-allow-all-scripts`
@@ -375,6 +387,10 @@ sources, the standard precedence applies (cli > env > project > user >
375387
global), so a higher-priority source can always relax or override a
376388
lower-priority one.
377389

390+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
391+
fix` would install, npm keeps the vulnerable version, warns, and exits with
392+
a non-zero code.
393+
378394
Packages whose names match `min-release-age-exclude` are exempt from this
379395
filter.
380396

@@ -397,6 +413,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
397413
apply, `before` wins within a single source and across sources the standard
398414
precedence rules apply.
399415

416+
When this window stops `npm audit fix` from installing a patched version
417+
(because the fix was published too recently), npm keeps the package at its
418+
vulnerable version, warns that the fix was blocked, and exits with a
419+
non-zero code. To install the fix, add the package to
420+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
421+
400422
Packages whose names match `min-release-age-exclude` are exempt from this
401423
filter.
402424

‎deps/npm/docs/content/commands/npm-install.md‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -410,8 +410,16 @@ Sets the strategy for installing packages in node_modules. hoisted
410410
(default): Install non-duplicated in top-level, and duplicated as necessary
411411
within directory structure. nested: (formerly --legacy-bundling) install in
412412
place, no hoisting. shallow (formerly --global-style) only install direct
413-
deps at top-level. linked: (experimental) install in node_modules/.store,
414-
link in place, unhoisted.
413+
deps at top-level. linked: install in node_modules/.store, link in place,
414+
unhoisted.
415+
416+
We recommend that package authors use `--install-strategy=linked` during
417+
development to catch undeclared ("phantom") dependencies before publishing:
418+
the isolated layout only exposes a package's declared dependencies, so an
419+
`import` of a package that was never added to `package.json` can fail
420+
instead of resolving by accident and shipping broken. See [Catching
421+
undeclared ("phantom")
422+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
415423

416424

417425

@@ -670,6 +678,10 @@ silently skipped; this setting only affects unreviewed entries.
670678
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
671679
setting.
672680
681+
Optional dependencies that cannot be installed on the current platform or
682+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
683+
their install scripts never run.
684+
673685
674686
675687
#### `dangerously-allow-all-scripts`
@@ -717,6 +729,10 @@ sources, the standard precedence applies (cli > env > project > user >
717729
global), so a higher-priority source can always relax or override a
718730
lower-priority one.
719731
732+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
733+
fix` would install, npm keeps the vulnerable version, warns, and exits with
734+
a non-zero code.
735+
720736
Packages whose names match `min-release-age-exclude` are exempt from this
721737
filter.
722738
@@ -739,6 +755,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
739755
apply, `before` wins within a single source and across sources the standard
740756
precedence rules apply.
741757
758+
When this window stops `npm audit fix` from installing a patched version
759+
(because the fix was published too recently), npm keeps the package at its
760+
vulnerable version, warns that the fix was blocked, and exits with a
761+
non-zero code. To install the fix, add the package to
762+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
763+
742764
Packages whose names match `min-release-age-exclude` are exempt from this
743765
filter.
744766

0 commit comments

Comments
 (0)
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Commit 7ac97fc
Browse files
npm-cli-botaduh95
npm-cli-bot
authored and
aduh95
committed
deps: upgrade npm to 11.18.0
PR-URL: #64199
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
1 parent 2ef4b7e commit 7ac97fc
293 files changed
Lines changed: 3844 additions & 723 deletions
File tree
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
‎deps/npm/docs/content/commands/npm-approve-scripts.md‎
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ the command cannot infer. Existing `false` entries always win;
5959
`approve-scripts` will not silently re-allow a package you previously
6060
denied.
6161

62+
If a registry dependency has no `resolved` URL in your `package-lock.json`
63+
(for example, an older lockfile or one written with
64+
`omit-lockfile-registry-resolved`), npm cannot verify a trusted version for
65+
it and cannot pin it: a `pkg@1.2.3` entry never matches, so the package
66+
keeps appearing under `--allow-scripts-pending`. `approve-scripts` approves
67+
these by name (`pkg: true`) and warns when it does. To restore pinning,
68+
refresh the lockfile with `npm install`.
69+
6270
### Examples
6371

6472
```bash
‎deps/npm/docs/content/commands/npm-ci.md‎
Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987

8088

8189

@@ -298,6 +306,10 @@ silently skipped; this setting only affects unreviewed entries.
298306
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
299307
setting.
300308

309+
Optional dependencies that cannot be installed on the current platform or
310+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
311+
their install scripts never run.
312+
301313

302314

303315
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-dedupe.md‎
Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987
8088
8189
‎deps/npm/docs/content/commands/npm-exec.md‎
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,10 @@ silently skipped; this setting only affects unreviewed entries.
194194
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
195195
setting.
196196

197+
Optional dependencies that cannot be installed on the current platform or
198+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
199+
their install scripts never run.
200+
197201

198202

199203
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-find-dupes.md‎
Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2525
(default): Install non-duplicated in top-level, and duplicated as necessary
2626
within directory structure. nested: (formerly --legacy-bundling) install in
2727
place, no hoisting. shallow (formerly --global-style) only install direct
28-
deps at top-level. linked: (experimental) install in node_modules/.store,
29-
link in place, unhoisted.
28+
deps at top-level. linked: install in node_modules/.store, link in place,
29+
unhoisted.
30+
31+
We recommend that package authors use `--install-strategy=linked` during
32+
development to catch undeclared ("phantom") dependencies before publishing:
33+
the isolated layout only exposes a package's declared dependencies, so an
34+
`import` of a package that was never added to `package.json` can fail
35+
instead of resolving by accident and shipping broken. See [Catching
36+
undeclared ("phantom")
37+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3038

3139

3240

‎deps/npm/docs/content/commands/npm-install-ci-test.md‎
Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2727
(default): Install non-duplicated in top-level, and duplicated as necessary
2828
within directory structure. nested: (formerly --legacy-bundling) install in
2929
place, no hoisting. shallow (formerly --global-style) only install direct
30-
deps at top-level. linked: (experimental) install in node_modules/.store,
31-
link in place, unhoisted.
30+
deps at top-level. linked: install in node_modules/.store, link in place,
31+
unhoisted.
32+
33+
We recommend that package authors use `--install-strategy=linked` during
34+
development to catch undeclared ("phantom") dependencies before publishing:
35+
the isolated layout only exposes a package's declared dependencies, so an
36+
`import` of a package that was never added to `package.json` can fail
37+
instead of resolving by accident and shipping broken. See [Catching
38+
undeclared ("phantom")
39+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3240

3341

3442

@@ -251,6 +259,10 @@ silently skipped; this setting only affects unreviewed entries.
251259
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
252260
setting.
253261

262+
Optional dependencies that cannot be installed on the current platform or
263+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
264+
their install scripts never run.
265+
254266

255267

256268
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-install-scripts.md‎
Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
---
2+
title: npm-install-scripts
3+
section: 1
4+
description: Manage install-script approvals for dependencies
5+
---
6+
7+
### Synopsis
8+
9+
```bash
10+
npm install-scripts approve <pkg> [<pkg> ...]
11+
npm install-scripts approve --all
12+
npm install-scripts deny <pkg> [<pkg> ...]
13+
npm install-scripts deny --all
14+
npm install-scripts ls
15+
npm install-scripts prune
16+
```
17+
18+
Note: This command is unaware of workspaces.
19+
20+
### Description
21+
22+
Manages the `allowScripts` field in your project's `package.json`, which
23+
records which of your dependencies are permitted to run install scripts
24+
(`preinstall`, `install`, `postinstall`, and `prepare` for non-registry
25+
sources). This is the recommended way to maintain that field.
26+
27+
Dependency install scripts are blocked by default. Install commands
28+
silently skip lifecycle scripts for any dependency that does not have a
29+
matching entry in `allowScripts`, and end with a list of the packages
30+
whose scripts were skipped so you can review them here.
31+
32+
This command only works inside a project that has a `package.json`. Running
33+
it with `--global` (`-g`) fails with an `EGLOBAL` error, since global
34+
installs (`npm install -g`) and one-off executions (`npm exec` / `npx`) have
35+
no project `package.json` to write to. To allow install scripts in those
36+
contexts, use the `--allow-scripts` flag at install time (for example
37+
`npm install -g --allow-scripts=canvas,sharp`) or persist the setting with
38+
`npm config set allow-scripts=canvas,sharp --location=user`.
39+
40+
There are four subcommands:
41+
42+
```bash
43+
npm install-scripts approve <pkg> [<pkg> ...]
44+
npm install-scripts approve --all
45+
npm install-scripts deny <pkg> [<pkg> ...]
46+
npm install-scripts deny --all
47+
npm install-scripts ls
48+
npm install-scripts prune
49+
```
50+
51+
`approve` allows install scripts for the named packages. `<pkg>` matches
52+
every installed version of that package. By default it writes pinned entries
53+
(`pkg@1.2.3`), which keep their approval narrowed to the specific version you
54+
reviewed. Pass `--no-allow-scripts-pin` to write name-only entries that allow
55+
any future version. `--all` approves every package with unreviewed install
56+
scripts in one go.
57+
58+
`deny` records an explicit denial for the named packages (a name-only `false`
59+
entry), which survives `npm install-scripts approve --all` and excludes the
60+
package from any future blanket approval. `--all` denies every package with
61+
unreviewed install scripts.
62+
63+
`ls` is read-only: it lists every package whose install scripts are not yet
64+
covered by `allowScripts`, without modifying `package.json`.
65+
66+
`prune` removes `allowScripts` entries that no longer match an installed
67+
package with an install script, either because the package is no longer
68+
installed (a transitive dependency changed, or a pinned `pkg@1.2.3` was
69+
upgraded) or because it no longer has an install script. Both approvals
70+
(`true`) and denials (`false`) are removed. It edits only the `allowScripts`
71+
field in `package.json`, never `.npmrc` or `--allow-scripts`. Pass `--dry-run`
72+
to preview without writing. Unparseable keys are left alone.
73+
74+
`approve` honours the asymmetric pin rule: if you re-approve a package whose
75+
installed version has changed, the existing pin is rewritten to track the new
76+
installed version. Multi-version statements (`pkg@1 || 2`) are left alone,
77+
since they likely capture intent that the command cannot infer. Existing
78+
`false` entries always win; `approve` will not silently re-allow a package you
79+
previously denied.
80+
81+
The standalone commands [`npm approve-scripts`](/commands/npm-approve-scripts)
82+
and [`npm deny-scripts`](/commands/npm-deny-scripts) are aliases for
83+
`npm install-scripts approve` and `npm install-scripts deny`.
84+
85+
### Examples
86+
87+
```bash
88+
# Approve all currently-installed install scripts after reviewing them
89+
npm install-scripts approve --all
90+
91+
# Approve specific packages, pinned to their installed version
92+
npm install-scripts approve canvas sharp
93+
94+
# Deny a package so it stays blocked
95+
npm install-scripts deny telemetry-pkg
96+
97+
# Preview which packages still need review
98+
npm install-scripts ls
99+
100+
# Preview stale allowScripts entries, then remove them
101+
npm install-scripts prune --dry-run
102+
npm install-scripts prune
103+
```
104+
105+
### Configuration
106+
107+
#### `all`
108+
109+
* Default: false
110+
* Type: Boolean
111+
112+
Show or act on all packages, not just the ones your project directly depends
113+
on. For `npm outdated` and `npm ls` this lists every outdated or installed
114+
package. For `npm approve-scripts` and `npm deny-scripts` it selects every
115+
package with pending install scripts.
116+
117+
118+
119+
#### `allow-scripts-pin`
120+
121+
* Default: true
122+
* Type: Boolean
123+
124+
Write pinned (`pkg@version`) entries when approving install scripts. Set to
125+
`false` to write name-only entries that allow any version. Has no effect on
126+
`npm deny-scripts`, which always writes name-only entries regardless of this
127+
setting.
128+
129+
130+
131+
#### `dry-run`
132+
133+
* Default: false
134+
* Type: Boolean
135+
136+
Indicates that you don't want npm to make any changes and that it should
137+
only report what it would have done. This can be passed into any of the
138+
commands that modify your local installation, eg, `install`, `update`,
139+
`dedupe`, `uninstall`, as well as `pack` and `publish`.
140+
141+
Note: This is NOT honored by other network related commands, eg `dist-tags`,
142+
`owner`, etc.
143+
144+
145+
146+
#### `json`
147+
148+
* Default: false
149+
* Type: Boolean
150+
151+
Whether or not to output JSON data, rather than the normal output.
152+
153+
* In `npm pkg set` it enables parsing set values with JSON.parse() before
154+
 saving them to your `package.json`.
155+
156+
Not supported by all npm commands.
157+
158+
159+
160+
### See Also
161+
162+
*[npm approve-scripts](/commands/npm-approve-scripts)
163+
*[npm deny-scripts](/commands/npm-deny-scripts)
164+
*[npm install](/commands/npm-install)
165+
*[npm rebuild](/commands/npm-rebuild)
166+
*[package.json](/configuring-npm/package-json)
‎deps/npm/docs/content/commands/npm-install-test.md‎
Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,16 @@ Sets the strategy for installing packages in node_modules. hoisted
6868
(default): Install non-duplicated in top-level, and duplicated as necessary
6969
within directory structure. nested: (formerly --legacy-bundling) install in
7070
place, no hoisting. shallow (formerly --global-style) only install direct
71-
deps at top-level. linked: (experimental) install in node_modules/.store,
72-
link in place, unhoisted.
71+
deps at top-level. linked: install in node_modules/.store, link in place,
72+
unhoisted.
73+
74+
We recommend that package authors use `--install-strategy=linked` during
75+
development to catch undeclared ("phantom") dependencies before publishing:
76+
the isolated layout only exposes a package's declared dependencies, so an
77+
`import` of a package that was never added to `package.json` can fail
78+
instead of resolving by accident and shipping broken. See [Catching
79+
undeclared ("phantom")
80+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7381

7482

7583

@@ -328,6 +336,10 @@ silently skipped; this setting only affects unreviewed entries.
328336
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
329337
setting.
330338

339+
Optional dependencies that cannot be installed on the current platform or
340+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
341+
their install scripts never run.
342+
331343

332344

333345
#### `dangerously-allow-all-scripts`
@@ -375,6 +387,10 @@ sources, the standard precedence applies (cli > env > project > user >
375387
global), so a higher-priority source can always relax or override a
376388
lower-priority one.
377389

390+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
391+
fix` would install, npm keeps the vulnerable version, warns, and exits with
392+
a non-zero code.
393+
378394
Packages whose names match `min-release-age-exclude` are exempt from this
379395
filter.
380396

@@ -397,6 +413,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
397413
apply, `before` wins within a single source and across sources the standard
398414
precedence rules apply.
399415

416+
When this window stops `npm audit fix` from installing a patched version
417+
(because the fix was published too recently), npm keeps the package at its
418+
vulnerable version, warns that the fix was blocked, and exits with a
419+
non-zero code. To install the fix, add the package to
420+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
421+
400422
Packages whose names match `min-release-age-exclude` are exempt from this
401423
filter.
402424

‎deps/npm/docs/content/commands/npm-install.md‎
Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -410,8 +410,16 @@ Sets the strategy for installing packages in node_modules. hoisted
410410
(default): Install non-duplicated in top-level, and duplicated as necessary
411411
within directory structure. nested: (formerly --legacy-bundling) install in
412412
place, no hoisting. shallow (formerly --global-style) only install direct
413-
deps at top-level. linked: (experimental) install in node_modules/.store,
414-
link in place, unhoisted.
413+
deps at top-level. linked: install in node_modules/.store, link in place,
414+
unhoisted.
415+
416+
We recommend that package authors use `--install-strategy=linked` during
417+
development to catch undeclared ("phantom") dependencies before publishing:
418+
the isolated layout only exposes a package's declared dependencies, so an
419+
`import` of a package that was never added to `package.json` can fail
420+
instead of resolving by accident and shipping broken. See [Catching
421+
undeclared ("phantom")
422+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
415423

416424

417425

@@ -670,6 +678,10 @@ silently skipped; this setting only affects unreviewed entries.
670678
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
671679
setting.
672680
681+
Optional dependencies that cannot be installed on the current platform or
682+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
683+
their install scripts never run.
684+
673685
674686
675687
#### `dangerously-allow-all-scripts`
@@ -717,6 +729,10 @@ sources, the standard precedence applies (cli > env > project > user >
717729
global), so a higher-priority source can always relax or override a
718730
lower-priority one.
719731
732+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
733+
fix` would install, npm keeps the vulnerable version, warns, and exits with
734+
a non-zero code.
735+
720736
Packages whose names match `min-release-age-exclude` are exempt from this
721737
filter.
722738
@@ -739,6 +755,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
739755
apply, `before` wins within a single source and across sources the standard
740756
precedence rules apply.
741757
758+
When this window stops `npm audit fix` from installing a patched version
759+
(because the fix was published too recently), npm keeps the package at its
760+
vulnerable version, warns that the fix was blocked, and exits with a
761+
non-zero code. To install the fix, add the package to
762+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
763+
742764
Packages whose names match `min-release-age-exclude` are exempt from this
743765
filter.
744766
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit 7ac97fc
Browse files
npm-cli-botaduh95
npm-cli-bot
authored and
aduh95
committed
deps: upgrade npm to 11.18.0
PR-URL: #64199
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
1 parent 2ef4b7e commit 7ac97fc
293 files changed
Lines changed: 3844 additions & 723 deletions
File tree
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
‎deps/npm/docs/content/commands/npm-approve-scripts.md‎
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ the command cannot infer. Existing `false` entries always win;
5959
`approve-scripts` will not silently re-allow a package you previously
6060
denied.
6161

62+
If a registry dependency has no `resolved` URL in your `package-lock.json`
63+
(for example, an older lockfile or one written with
64+
`omit-lockfile-registry-resolved`), npm cannot verify a trusted version for
65+
it and cannot pin it: a `pkg@1.2.3` entry never matches, so the package
66+
keeps appearing under `--allow-scripts-pending`. `approve-scripts` approves
67+
these by name (`pkg: true`) and warns when it does. To restore pinning,
68+
refresh the lockfile with `npm install`.
69+
6270
### Examples
6371

6472
```bash
‎deps/npm/docs/content/commands/npm-ci.md‎
Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987

8088

8189

@@ -298,6 +306,10 @@ silently skipped; this setting only affects unreviewed entries.
298306
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
299307
setting.
300308

309+
Optional dependencies that cannot be installed on the current platform or
310+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
311+
their install scripts never run.
312+
301313

302314

303315
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-dedupe.md‎
Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987
8088
8189
‎deps/npm/docs/content/commands/npm-exec.md‎
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,10 @@ silently skipped; this setting only affects unreviewed entries.
194194
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
195195
setting.
196196

197+
Optional dependencies that cannot be installed on the current platform or
198+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
199+
their install scripts never run.
200+
197201

198202

199203
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-find-dupes.md‎
Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2525
(default): Install non-duplicated in top-level, and duplicated as necessary
2626
within directory structure. nested: (formerly --legacy-bundling) install in
2727
place, no hoisting. shallow (formerly --global-style) only install direct
28-
deps at top-level. linked: (experimental) install in node_modules/.store,
29-
link in place, unhoisted.
28+
deps at top-level. linked: install in node_modules/.store, link in place,
29+
unhoisted.
30+
31+
We recommend that package authors use `--install-strategy=linked` during
32+
development to catch undeclared ("phantom") dependencies before publishing:
33+
the isolated layout only exposes a package's declared dependencies, so an
34+
`import` of a package that was never added to `package.json` can fail
35+
instead of resolving by accident and shipping broken. See [Catching
36+
undeclared ("phantom")
37+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3038

3139

3240

‎deps/npm/docs/content/commands/npm-install-ci-test.md‎
Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2727
(default): Install non-duplicated in top-level, and duplicated as necessary
2828
within directory structure. nested: (formerly --legacy-bundling) install in
2929
place, no hoisting. shallow (formerly --global-style) only install direct
30-
deps at top-level. linked: (experimental) install in node_modules/.store,
31-
link in place, unhoisted.
30+
deps at top-level. linked: install in node_modules/.store, link in place,
31+
unhoisted.
32+
33+
We recommend that package authors use `--install-strategy=linked` during
34+
development to catch undeclared ("phantom") dependencies before publishing:
35+
the isolated layout only exposes a package's declared dependencies, so an
36+
`import` of a package that was never added to `package.json` can fail
37+
instead of resolving by accident and shipping broken. See [Catching
38+
undeclared ("phantom")
39+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3240

3341

3442

@@ -251,6 +259,10 @@ silently skipped; this setting only affects unreviewed entries.
251259
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
252260
setting.
253261

262+
Optional dependencies that cannot be installed on the current platform or
263+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
264+
their install scripts never run.
265+
254266

255267

256268
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-install-scripts.md‎
Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
---
2+
title: npm-install-scripts
3+
section: 1
4+
description: Manage install-script approvals for dependencies
5+
---
6+
7+
### Synopsis
8+
9+
```bash
10+
npm install-scripts approve <pkg> [<pkg> ...]
11+
npm install-scripts approve --all
12+
npm install-scripts deny <pkg> [<pkg> ...]
13+
npm install-scripts deny --all
14+
npm install-scripts ls
15+
npm install-scripts prune
16+
```
17+
18+
Note: This command is unaware of workspaces.
19+
20+
### Description
21+
22+
Manages the `allowScripts` field in your project's `package.json`, which
23+
records which of your dependencies are permitted to run install scripts
24+
(`preinstall`, `install`, `postinstall`, and `prepare` for non-registry
25+
sources). This is the recommended way to maintain that field.
26+
27+
Dependency install scripts are blocked by default. Install commands
28+
silently skip lifecycle scripts for any dependency that does not have a
29+
matching entry in `allowScripts`, and end with a list of the packages
30+
whose scripts were skipped so you can review them here.
31+
32+
This command only works inside a project that has a `package.json`. Running
33+
it with `--global` (`-g`) fails with an `EGLOBAL` error, since global
34+
installs (`npm install -g`) and one-off executions (`npm exec` / `npx`) have
35+
no project `package.json` to write to. To allow install scripts in those
36+
contexts, use the `--allow-scripts` flag at install time (for example
37+
`npm install -g --allow-scripts=canvas,sharp`) or persist the setting with
38+
`npm config set allow-scripts=canvas,sharp --location=user`.
39+
40+
There are four subcommands:
41+
42+
```bash
43+
npm install-scripts approve <pkg> [<pkg> ...]
44+
npm install-scripts approve --all
45+
npm install-scripts deny <pkg> [<pkg> ...]
46+
npm install-scripts deny --all
47+
npm install-scripts ls
48+
npm install-scripts prune
49+
```
50+
51+
`approve` allows install scripts for the named packages. `<pkg>` matches
52+
every installed version of that package. By default it writes pinned entries
53+
(`pkg@1.2.3`), which keep their approval narrowed to the specific version you
54+
reviewed. Pass `--no-allow-scripts-pin` to write name-only entries that allow
55+
any future version. `--all` approves every package with unreviewed install
56+
scripts in one go.
57+
58+
`deny` records an explicit denial for the named packages (a name-only `false`
59+
entry), which survives `npm install-scripts approve --all` and excludes the
60+
package from any future blanket approval. `--all` denies every package with
61+
unreviewed install scripts.
62+
63+
`ls` is read-only: it lists every package whose install scripts are not yet
64+
covered by `allowScripts`, without modifying `package.json`.
65+
66+
`prune` removes `allowScripts` entries that no longer match an installed
67+
package with an install script, either because the package is no longer
68+
installed (a transitive dependency changed, or a pinned `pkg@1.2.3` was
69+
upgraded) or because it no longer has an install script. Both approvals
70+
(`true`) and denials (`false`) are removed. It edits only the `allowScripts`
71+
field in `package.json`, never `.npmrc` or `--allow-scripts`. Pass `--dry-run`
72+
to preview without writing. Unparseable keys are left alone.
73+
74+
`approve` honours the asymmetric pin rule: if you re-approve a package whose
75+
installed version has changed, the existing pin is rewritten to track the new
76+
installed version. Multi-version statements (`pkg@1 || 2`) are left alone,
77+
since they likely capture intent that the command cannot infer. Existing
78+
`false` entries always win; `approve` will not silently re-allow a package you
79+
previously denied.
80+
81+
The standalone commands [`npm approve-scripts`](/commands/npm-approve-scripts)
82+
and [`npm deny-scripts`](/commands/npm-deny-scripts) are aliases for
83+
`npm install-scripts approve` and `npm install-scripts deny`.
84+
85+
### Examples
86+
87+
```bash
88+
# Approve all currently-installed install scripts after reviewing them
89+
npm install-scripts approve --all
90+
91+
# Approve specific packages, pinned to their installed version
92+
npm install-scripts approve canvas sharp
93+
94+
# Deny a package so it stays blocked
95+
npm install-scripts deny telemetry-pkg
96+
97+
# Preview which packages still need review
98+
npm install-scripts ls
99+
100+
# Preview stale allowScripts entries, then remove them
101+
npm install-scripts prune --dry-run
102+
npm install-scripts prune
103+
```
104+
105+
### Configuration
106+
107+
#### `all`
108+
109+
* Default: false
110+
* Type: Boolean
111+
112+
Show or act on all packages, not just the ones your project directly depends
113+
on. For `npm outdated` and `npm ls` this lists every outdated or installed
114+
package. For `npm approve-scripts` and `npm deny-scripts` it selects every
115+
package with pending install scripts.
116+
117+
118+
119+
#### `allow-scripts-pin`
120+
121+
* Default: true
122+
* Type: Boolean
123+
124+
Write pinned (`pkg@version`) entries when approving install scripts. Set to
125+
`false` to write name-only entries that allow any version. Has no effect on
126+
`npm deny-scripts`, which always writes name-only entries regardless of this
127+
setting.
128+
129+
130+
131+
#### `dry-run`
132+
133+
* Default: false
134+
* Type: Boolean
135+
136+
Indicates that you don't want npm to make any changes and that it should
137+
only report what it would have done. This can be passed into any of the
138+
commands that modify your local installation, eg, `install`, `update`,
139+
`dedupe`, `uninstall`, as well as `pack` and `publish`.
140+
141+
Note: This is NOT honored by other network related commands, eg `dist-tags`,
142+
`owner`, etc.
143+
144+
145+
146+
#### `json`
147+
148+
* Default: false
149+
* Type: Boolean
150+
151+
Whether or not to output JSON data, rather than the normal output.
152+
153+
* In `npm pkg set` it enables parsing set values with JSON.parse() before
154+
 saving them to your `package.json`.
155+
156+
Not supported by all npm commands.
157+
158+
159+
160+
### See Also
161+
162+
*[npm approve-scripts](/commands/npm-approve-scripts)
163+
*[npm deny-scripts](/commands/npm-deny-scripts)
164+
*[npm install](/commands/npm-install)
165+
*[npm rebuild](/commands/npm-rebuild)
166+
*[package.json](/configuring-npm/package-json)
‎deps/npm/docs/content/commands/npm-install-test.md‎
Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,16 @@ Sets the strategy for installing packages in node_modules. hoisted
6868
(default): Install non-duplicated in top-level, and duplicated as necessary
6969
within directory structure. nested: (formerly --legacy-bundling) install in
7070
place, no hoisting. shallow (formerly --global-style) only install direct
71-
deps at top-level. linked: (experimental) install in node_modules/.store,
72-
link in place, unhoisted.
71+
deps at top-level. linked: install in node_modules/.store, link in place,
72+
unhoisted.
73+
74+
We recommend that package authors use `--install-strategy=linked` during
75+
development to catch undeclared ("phantom") dependencies before publishing:
76+
the isolated layout only exposes a package's declared dependencies, so an
77+
`import` of a package that was never added to `package.json` can fail
78+
instead of resolving by accident and shipping broken. See [Catching
79+
undeclared ("phantom")
80+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7381

7482

7583

@@ -328,6 +336,10 @@ silently skipped; this setting only affects unreviewed entries.
328336
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
329337
setting.
330338

339+
Optional dependencies that cannot be installed on the current platform or
340+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
341+
their install scripts never run.
342+
331343

332344

333345
#### `dangerously-allow-all-scripts`
@@ -375,6 +387,10 @@ sources, the standard precedence applies (cli > env > project > user >
375387
global), so a higher-priority source can always relax or override a
376388
lower-priority one.
377389

390+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
391+
fix` would install, npm keeps the vulnerable version, warns, and exits with
392+
a non-zero code.
393+
378394
Packages whose names match `min-release-age-exclude` are exempt from this
379395
filter.
380396

@@ -397,6 +413,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
397413
apply, `before` wins within a single source and across sources the standard
398414
precedence rules apply.
399415

416+
When this window stops `npm audit fix` from installing a patched version
417+
(because the fix was published too recently), npm keeps the package at its
418+
vulnerable version, warns that the fix was blocked, and exits with a
419+
non-zero code. To install the fix, add the package to
420+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
421+
400422
Packages whose names match `min-release-age-exclude` are exempt from this
401423
filter.
402424

‎deps/npm/docs/content/commands/npm-install.md‎
Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -410,8 +410,16 @@ Sets the strategy for installing packages in node_modules. hoisted
410410
(default): Install non-duplicated in top-level, and duplicated as necessary
411411
within directory structure. nested: (formerly --legacy-bundling) install in
412412
place, no hoisting. shallow (formerly --global-style) only install direct
413-
deps at top-level. linked: (experimental) install in node_modules/.store,
414-
link in place, unhoisted.
413+
deps at top-level. linked: install in node_modules/.store, link in place,
414+
unhoisted.
415+
416+
We recommend that package authors use `--install-strategy=linked` during
417+
development to catch undeclared ("phantom") dependencies before publishing:
418+
the isolated layout only exposes a package's declared dependencies, so an
419+
`import` of a package that was never added to `package.json` can fail
420+
instead of resolving by accident and shipping broken. See [Catching
421+
undeclared ("phantom")
422+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
415423

416424

417425

@@ -670,6 +678,10 @@ silently skipped; this setting only affects unreviewed entries.
670678
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
671679
setting.
672680
681+
Optional dependencies that cannot be installed on the current platform or
682+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
683+
their install scripts never run.
684+
673685
674686
675687
#### `dangerously-allow-all-scripts`
@@ -717,6 +729,10 @@ sources, the standard precedence applies (cli > env > project > user >
717729
global), so a higher-priority source can always relax or override a
718730
lower-priority one.
719731
732+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
733+
fix` would install, npm keeps the vulnerable version, warns, and exits with
734+
a non-zero code.
735+
720736
Packages whose names match `min-release-age-exclude` are exempt from this
721737
filter.
722738
@@ -739,6 +755,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
739755
apply, `before` wins within a single source and across sources the standard
740756
precedence rules apply.
741757
758+
When this window stops `npm audit fix` from installing a patched version
759+
(because the fix was published too recently), npm keeps the package at its
760+
vulnerable version, warns that the fix was blocked, and exits with a
761+
non-zero code. To install the fix, add the package to
762+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
763+
742764
Packages whose names match `min-release-age-exclude` are exempt from this
743765
filter.
744766
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit 7ac97fc
Browse files
npm-cli-botaduh95
npm-cli-bot
authored and
aduh95
committed
deps: upgrade npm to 11.18.0
PR-URL: #64199
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
1 parent 2ef4b7e commit 7ac97fc
293 files changed
Lines changed: 3844 additions & 723 deletions
File tree
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
‎deps/npm/docs/content/commands/npm-approve-scripts.md‎
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ the command cannot infer. Existing `false` entries always win;
5959
`approve-scripts` will not silently re-allow a package you previously
6060
denied.
6161

62+
If a registry dependency has no `resolved` URL in your `package-lock.json`
63+
(for example, an older lockfile or one written with
64+
`omit-lockfile-registry-resolved`), npm cannot verify a trusted version for
65+
it and cannot pin it: a `pkg@1.2.3` entry never matches, so the package
66+
keeps appearing under `--allow-scripts-pending`. `approve-scripts` approves
67+
these by name (`pkg: true`) and warns when it does. To restore pinning,
68+
refresh the lockfile with `npm install`.
69+
6270
### Examples
6371

6472
```bash
‎deps/npm/docs/content/commands/npm-ci.md‎
Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987

8088

8189

@@ -298,6 +306,10 @@ silently skipped; this setting only affects unreviewed entries.
298306
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
299307
setting.
300308

309+
Optional dependencies that cannot be installed on the current platform or
310+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
311+
their install scripts never run.
312+
301313

302314

303315
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-dedupe.md‎
Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987
8088
8189
‎deps/npm/docs/content/commands/npm-exec.md‎
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,10 @@ silently skipped; this setting only affects unreviewed entries.
194194
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
195195
setting.
196196

197+
Optional dependencies that cannot be installed on the current platform or
198+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
199+
their install scripts never run.
200+
197201

198202

199203
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-find-dupes.md‎
Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2525
(default): Install non-duplicated in top-level, and duplicated as necessary
2626
within directory structure. nested: (formerly --legacy-bundling) install in
2727
place, no hoisting. shallow (formerly --global-style) only install direct
28-
deps at top-level. linked: (experimental) install in node_modules/.store,
29-
link in place, unhoisted.
28+
deps at top-level. linked: install in node_modules/.store, link in place,
29+
unhoisted.
30+
31+
We recommend that package authors use `--install-strategy=linked` during
32+
development to catch undeclared ("phantom") dependencies before publishing:
33+
the isolated layout only exposes a package's declared dependencies, so an
34+
`import` of a package that was never added to `package.json` can fail
35+
instead of resolving by accident and shipping broken. See [Catching
36+
undeclared ("phantom")
37+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3038

3139

3240

‎deps/npm/docs/content/commands/npm-install-ci-test.md‎
Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2727
(default): Install non-duplicated in top-level, and duplicated as necessary
2828
within directory structure. nested: (formerly --legacy-bundling) install in
2929
place, no hoisting. shallow (formerly --global-style) only install direct
30-
deps at top-level. linked: (experimental) install in node_modules/.store,
31-
link in place, unhoisted.
30+
deps at top-level. linked: install in node_modules/.store, link in place,
31+
unhoisted.
32+
33+
We recommend that package authors use `--install-strategy=linked` during
34+
development to catch undeclared ("phantom") dependencies before publishing:
35+
the isolated layout only exposes a package's declared dependencies, so an
36+
`import` of a package that was never added to `package.json` can fail
37+
instead of resolving by accident and shipping broken. See [Catching
38+
undeclared ("phantom")
39+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3240

3341

3442

@@ -251,6 +259,10 @@ silently skipped; this setting only affects unreviewed entries.
251259
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
252260
setting.
253261

262+
Optional dependencies that cannot be installed on the current platform or
263+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
264+
their install scripts never run.
265+
254266

255267

256268
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-install-scripts.md‎
Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
---
2+
title: npm-install-scripts
3+
section: 1
4+
description: Manage install-script approvals for dependencies
5+
---
6+
7+
### Synopsis
8+
9+
```bash
10+
npm install-scripts approve <pkg> [<pkg> ...]
11+
npm install-scripts approve --all
12+
npm install-scripts deny <pkg> [<pkg> ...]
13+
npm install-scripts deny --all
14+
npm install-scripts ls
15+
npm install-scripts prune
16+
```
17+
18+
Note: This command is unaware of workspaces.
19+
20+
### Description
21+
22+
Manages the `allowScripts` field in your project's `package.json`, which
23+
records which of your dependencies are permitted to run install scripts
24+
(`preinstall`, `install`, `postinstall`, and `prepare` for non-registry
25+
sources). This is the recommended way to maintain that field.
26+
27+
Dependency install scripts are blocked by default. Install commands
28+
silently skip lifecycle scripts for any dependency that does not have a
29+
matching entry in `allowScripts`, and end with a list of the packages
30+
whose scripts were skipped so you can review them here.
31+
32+
This command only works inside a project that has a `package.json`. Running
33+
it with `--global` (`-g`) fails with an `EGLOBAL` error, since global
34+
installs (`npm install -g`) and one-off executions (`npm exec` / `npx`) have
35+
no project `package.json` to write to. To allow install scripts in those
36+
contexts, use the `--allow-scripts` flag at install time (for example
37+
`npm install -g --allow-scripts=canvas,sharp`) or persist the setting with
38+
`npm config set allow-scripts=canvas,sharp --location=user`.
39+
40+
There are four subcommands:
41+
42+
```bash
43+
npm install-scripts approve <pkg> [<pkg> ...]
44+
npm install-scripts approve --all
45+
npm install-scripts deny <pkg> [<pkg> ...]
46+
npm install-scripts deny --all
47+
npm install-scripts ls
48+
npm install-scripts prune
49+
```
50+
51+
`approve` allows install scripts for the named packages. `<pkg>` matches
52+
every installed version of that package. By default it writes pinned entries
53+
(`pkg@1.2.3`), which keep their approval narrowed to the specific version you
54+
reviewed. Pass `--no-allow-scripts-pin` to write name-only entries that allow
55+
any future version. `--all` approves every package with unreviewed install
56+
scripts in one go.
57+
58+
`deny` records an explicit denial for the named packages (a name-only `false`
59+
entry), which survives `npm install-scripts approve --all` and excludes the
60+
package from any future blanket approval. `--all` denies every package with
61+
unreviewed install scripts.
62+
63+
`ls` is read-only: it lists every package whose install scripts are not yet
64+
covered by `allowScripts`, without modifying `package.json`.
65+
66+
`prune` removes `allowScripts` entries that no longer match an installed
67+
package with an install script, either because the package is no longer
68+
installed (a transitive dependency changed, or a pinned `pkg@1.2.3` was
69+
upgraded) or because it no longer has an install script. Both approvals
70+
(`true`) and denials (`false`) are removed. It edits only the `allowScripts`
71+
field in `package.json`, never `.npmrc` or `--allow-scripts`. Pass `--dry-run`
72+
to preview without writing. Unparseable keys are left alone.
73+
74+
`approve` honours the asymmetric pin rule: if you re-approve a package whose
75+
installed version has changed, the existing pin is rewritten to track the new
76+
installed version. Multi-version statements (`pkg@1 || 2`) are left alone,
77+
since they likely capture intent that the command cannot infer. Existing
78+
`false` entries always win; `approve` will not silently re-allow a package you
79+
previously denied.
80+
81+
The standalone commands [`npm approve-scripts`](/commands/npm-approve-scripts)
82+
and [`npm deny-scripts`](/commands/npm-deny-scripts) are aliases for
83+
`npm install-scripts approve` and `npm install-scripts deny`.
84+
85+
### Examples
86+
87+
```bash
88+
# Approve all currently-installed install scripts after reviewing them
89+
npm install-scripts approve --all
90+
91+
# Approve specific packages, pinned to their installed version
92+
npm install-scripts approve canvas sharp
93+
94+
# Deny a package so it stays blocked
95+
npm install-scripts deny telemetry-pkg
96+
97+
# Preview which packages still need review
98+
npm install-scripts ls
99+
100+
# Preview stale allowScripts entries, then remove them
101+
npm install-scripts prune --dry-run
102+
npm install-scripts prune
103+
```
104+
105+
### Configuration
106+
107+
#### `all`
108+
109+
* Default: false
110+
* Type: Boolean
111+
112+
Show or act on all packages, not just the ones your project directly depends
113+
on. For `npm outdated` and `npm ls` this lists every outdated or installed
114+
package. For `npm approve-scripts` and `npm deny-scripts` it selects every
115+
package with pending install scripts.
116+
117+
118+
119+
#### `allow-scripts-pin`
120+
121+
* Default: true
122+
* Type: Boolean
123+
124+
Write pinned (`pkg@version`) entries when approving install scripts. Set to
125+
`false` to write name-only entries that allow any version. Has no effect on
126+
`npm deny-scripts`, which always writes name-only entries regardless of this
127+
setting.
128+
129+
130+
131+
#### `dry-run`
132+
133+
* Default: false
134+
* Type: Boolean
135+
136+
Indicates that you don't want npm to make any changes and that it should
137+
only report what it would have done. This can be passed into any of the
138+
commands that modify your local installation, eg, `install`, `update`,
139+
`dedupe`, `uninstall`, as well as `pack` and `publish`.
140+
141+
Note: This is NOT honored by other network related commands, eg `dist-tags`,
142+
`owner`, etc.
143+
144+
145+
146+
#### `json`
147+
148+
* Default: false
149+
* Type: Boolean
150+
151+
Whether or not to output JSON data, rather than the normal output.
152+
153+
* In `npm pkg set` it enables parsing set values with JSON.parse() before
154+
 saving them to your `package.json`.
155+
156+
Not supported by all npm commands.
157+
158+
159+
160+
### See Also
161+
162+
*[npm approve-scripts](/commands/npm-approve-scripts)
163+
*[npm deny-scripts](/commands/npm-deny-scripts)
164+
*[npm install](/commands/npm-install)
165+
*[npm rebuild](/commands/npm-rebuild)
166+
*[package.json](/configuring-npm/package-json)
‎deps/npm/docs/content/commands/npm-install-test.md‎
Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,16 @@ Sets the strategy for installing packages in node_modules. hoisted
6868
(default): Install non-duplicated in top-level, and duplicated as necessary
6969
within directory structure. nested: (formerly --legacy-bundling) install in
7070
place, no hoisting. shallow (formerly --global-style) only install direct
71-
deps at top-level. linked: (experimental) install in node_modules/.store,
72-
link in place, unhoisted.
71+
deps at top-level. linked: install in node_modules/.store, link in place,
72+
unhoisted.
73+
74+
We recommend that package authors use `--install-strategy=linked` during
75+
development to catch undeclared ("phantom") dependencies before publishing:
76+
the isolated layout only exposes a package's declared dependencies, so an
77+
`import` of a package that was never added to `package.json` can fail
78+
instead of resolving by accident and shipping broken. See [Catching
79+
undeclared ("phantom")
80+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7381

7482

7583

@@ -328,6 +336,10 @@ silently skipped; this setting only affects unreviewed entries.
328336
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
329337
setting.
330338

339+
Optional dependencies that cannot be installed on the current platform or
340+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
341+
their install scripts never run.
342+
331343

332344

333345
#### `dangerously-allow-all-scripts`
@@ -375,6 +387,10 @@ sources, the standard precedence applies (cli > env > project > user >
375387
global), so a higher-priority source can always relax or override a
376388
lower-priority one.
377389

390+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
391+
fix` would install, npm keeps the vulnerable version, warns, and exits with
392+
a non-zero code.
393+
378394
Packages whose names match `min-release-age-exclude` are exempt from this
379395
filter.
380396

@@ -397,6 +413,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
397413
apply, `before` wins within a single source and across sources the standard
398414
precedence rules apply.
399415

416+
When this window stops `npm audit fix` from installing a patched version
417+
(because the fix was published too recently), npm keeps the package at its
418+
vulnerable version, warns that the fix was blocked, and exits with a
419+
non-zero code. To install the fix, add the package to
420+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
421+
400422
Packages whose names match `min-release-age-exclude` are exempt from this
401423
filter.
402424

‎deps/npm/docs/content/commands/npm-install.md‎
Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -410,8 +410,16 @@ Sets the strategy for installing packages in node_modules. hoisted
410410
(default): Install non-duplicated in top-level, and duplicated as necessary
411411
within directory structure. nested: (formerly --legacy-bundling) install in
412412
place, no hoisting. shallow (formerly --global-style) only install direct
413-
deps at top-level. linked: (experimental) install in node_modules/.store,
414-
link in place, unhoisted.
413+
deps at top-level. linked: install in node_modules/.store, link in place,
414+
unhoisted.
415+
416+
We recommend that package authors use `--install-strategy=linked` during
417+
development to catch undeclared ("phantom") dependencies before publishing:
418+
the isolated layout only exposes a package's declared dependencies, so an
419+
`import` of a package that was never added to `package.json` can fail
420+
instead of resolving by accident and shipping broken. See [Catching
421+
undeclared ("phantom")
422+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
415423

416424

417425

@@ -670,6 +678,10 @@ silently skipped; this setting only affects unreviewed entries.
670678
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
671679
setting.
672680
681+
Optional dependencies that cannot be installed on the current platform or
682+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
683+
their install scripts never run.
684+
673685
674686
675687
#### `dangerously-allow-all-scripts`
@@ -717,6 +729,10 @@ sources, the standard precedence applies (cli > env > project > user >
717729
global), so a higher-priority source can always relax or override a
718730
lower-priority one.
719731
732+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
733+
fix` would install, npm keeps the vulnerable version, warns, and exits with
734+
a non-zero code.
735+
720736
Packages whose names match `min-release-age-exclude` are exempt from this
721737
filter.
722738
@@ -739,6 +755,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
739755
apply, `before` wins within a single source and across sources the standard
740756
precedence rules apply.
741757
758+
When this window stops `npm audit fix` from installing a patched version
759+
(because the fix was published too recently), npm keeps the package at its
760+
vulnerable version, warns that the fix was blocked, and exits with a
761+
non-zero code. To install the fix, add the package to
762+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
763+
742764
Packages whose names match `min-release-age-exclude` are exempt from this
743765
filter.
744766
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Commit 7ac97fc
Browse files
npm-cli-botaduh95
npm-cli-bot
authored and
aduh95
committed
deps: upgrade npm to 11.18.0
PR-URL: #64199
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
1 parent 2ef4b7e commit 7ac97fc
293 files changed
Lines changed: 3844 additions & 723 deletions
File tree
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
‎deps/npm/docs/content/commands/npm-approve-scripts.md‎
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ the command cannot infer. Existing `false` entries always win;
5959
`approve-scripts` will not silently re-allow a package you previously
6060
denied.
6161

62+
If a registry dependency has no `resolved` URL in your `package-lock.json`
63+
(for example, an older lockfile or one written with
64+
`omit-lockfile-registry-resolved`), npm cannot verify a trusted version for
65+
it and cannot pin it: a `pkg@1.2.3` entry never matches, so the package
66+
keeps appearing under `--allow-scripts-pending`. `approve-scripts` approves
67+
these by name (`pkg: true`) and warns when it does. To restore pinning,
68+
refresh the lockfile with `npm install`.
69+
6270
### Examples
6371

6472
```bash
‎deps/npm/docs/content/commands/npm-ci.md‎
Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987

8088

8189

@@ -298,6 +306,10 @@ silently skipped; this setting only affects unreviewed entries.
298306
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
299307
setting.
300308

309+
Optional dependencies that cannot be installed on the current platform or
310+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
311+
their install scripts never run.
312+
301313

302314

303315
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-dedupe.md‎
Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987
8088
8189
‎deps/npm/docs/content/commands/npm-exec.md‎
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,10 @@ silently skipped; this setting only affects unreviewed entries.
194194
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
195195
setting.
196196

197+
Optional dependencies that cannot be installed on the current platform or
198+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
199+
their install scripts never run.
200+
197201

198202

199203
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-find-dupes.md‎
Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2525
(default): Install non-duplicated in top-level, and duplicated as necessary
2626
within directory structure. nested: (formerly --legacy-bundling) install in
2727
place, no hoisting. shallow (formerly --global-style) only install direct
28-
deps at top-level. linked: (experimental) install in node_modules/.store,
29-
link in place, unhoisted.
28+
deps at top-level. linked: install in node_modules/.store, link in place,
29+
unhoisted.
30+
31+
We recommend that package authors use `--install-strategy=linked` during
32+
development to catch undeclared ("phantom") dependencies before publishing:
33+
the isolated layout only exposes a package's declared dependencies, so an
34+
`import` of a package that was never added to `package.json` can fail
35+
instead of resolving by accident and shipping broken. See [Catching
36+
undeclared ("phantom")
37+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3038

3139

3240

‎deps/npm/docs/content/commands/npm-install-ci-test.md‎
Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2727
(default): Install non-duplicated in top-level, and duplicated as necessary
2828
within directory structure. nested: (formerly --legacy-bundling) install in
2929
place, no hoisting. shallow (formerly --global-style) only install direct
30-
deps at top-level. linked: (experimental) install in node_modules/.store,
31-
link in place, unhoisted.
30+
deps at top-level. linked: install in node_modules/.store, link in place,
31+
unhoisted.
32+
33+
We recommend that package authors use `--install-strategy=linked` during
34+
development to catch undeclared ("phantom") dependencies before publishing:
35+
the isolated layout only exposes a package's declared dependencies, so an
36+
`import` of a package that was never added to `package.json` can fail
37+
instead of resolving by accident and shipping broken. See [Catching
38+
undeclared ("phantom")
39+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3240

3341

3442

@@ -251,6 +259,10 @@ silently skipped; this setting only affects unreviewed entries.
251259
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
252260
setting.
253261

262+
Optional dependencies that cannot be installed on the current platform or
263+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
264+
their install scripts never run.
265+
254266

255267

256268
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-install-scripts.md‎
Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
---
2+
title: npm-install-scripts
3+
section: 1
4+
description: Manage install-script approvals for dependencies
5+
---
6+
7+
### Synopsis
8+
9+
```bash
10+
npm install-scripts approve <pkg> [<pkg> ...]
11+
npm install-scripts approve --all
12+
npm install-scripts deny <pkg> [<pkg> ...]
13+
npm install-scripts deny --all
14+
npm install-scripts ls
15+
npm install-scripts prune
16+
```
17+
18+
Note: This command is unaware of workspaces.
19+
20+
### Description
21+
22+
Manages the `allowScripts` field in your project's `package.json`, which
23+
records which of your dependencies are permitted to run install scripts
24+
(`preinstall`, `install`, `postinstall`, and `prepare` for non-registry
25+
sources). This is the recommended way to maintain that field.
26+
27+
Dependency install scripts are blocked by default. Install commands
28+
silently skip lifecycle scripts for any dependency that does not have a
29+
matching entry in `allowScripts`, and end with a list of the packages
30+
whose scripts were skipped so you can review them here.
31+
32+
This command only works inside a project that has a `package.json`. Running
33+
it with `--global` (`-g`) fails with an `EGLOBAL` error, since global
34+
installs (`npm install -g`) and one-off executions (`npm exec` / `npx`) have
35+
no project `package.json` to write to. To allow install scripts in those
36+
contexts, use the `--allow-scripts` flag at install time (for example
37+
`npm install -g --allow-scripts=canvas,sharp`) or persist the setting with
38+
`npm config set allow-scripts=canvas,sharp --location=user`.
39+
40+
There are four subcommands:
41+
42+
```bash
43+
npm install-scripts approve <pkg> [<pkg> ...]
44+
npm install-scripts approve --all
45+
npm install-scripts deny <pkg> [<pkg> ...]
46+
npm install-scripts deny --all
47+
npm install-scripts ls
48+
npm install-scripts prune
49+
```
50+
51+
`approve` allows install scripts for the named packages. `<pkg>` matches
52+
every installed version of that package. By default it writes pinned entries
53+
(`pkg@1.2.3`), which keep their approval narrowed to the specific version you
54+
reviewed. Pass `--no-allow-scripts-pin` to write name-only entries that allow
55+
any future version. `--all` approves every package with unreviewed install
56+
scripts in one go.
57+
58+
`deny` records an explicit denial for the named packages (a name-only `false`
59+
entry), which survives `npm install-scripts approve --all` and excludes the
60+
package from any future blanket approval. `--all` denies every package with
61+
unreviewed install scripts.
62+
63+
`ls` is read-only: it lists every package whose install scripts are not yet
64+
covered by `allowScripts`, without modifying `package.json`.
65+
66+
`prune` removes `allowScripts` entries that no longer match an installed
67+
package with an install script, either because the package is no longer
68+
installed (a transitive dependency changed, or a pinned `pkg@1.2.3` was
69+
upgraded) or because it no longer has an install script. Both approvals
70+
(`true`) and denials (`false`) are removed. It edits only the `allowScripts`
71+
field in `package.json`, never `.npmrc` or `--allow-scripts`. Pass `--dry-run`
72+
to preview without writing. Unparseable keys are left alone.
73+
74+
`approve` honours the asymmetric pin rule: if you re-approve a package whose
75+
installed version has changed, the existing pin is rewritten to track the new
76+
installed version. Multi-version statements (`pkg@1 || 2`) are left alone,
77+
since they likely capture intent that the command cannot infer. Existing
78+
`false` entries always win; `approve` will not silently re-allow a package you
79+
previously denied.
80+
81+
The standalone commands [`npm approve-scripts`](/commands/npm-approve-scripts)
82+
and [`npm deny-scripts`](/commands/npm-deny-scripts) are aliases for
83+
`npm install-scripts approve` and `npm install-scripts deny`.
84+
85+
### Examples
86+
87+
```bash
88+
# Approve all currently-installed install scripts after reviewing them
89+
npm install-scripts approve --all
90+
91+
# Approve specific packages, pinned to their installed version
92+
npm install-scripts approve canvas sharp
93+
94+
# Deny a package so it stays blocked
95+
npm install-scripts deny telemetry-pkg
96+
97+
# Preview which packages still need review
98+
npm install-scripts ls
99+
100+
# Preview stale allowScripts entries, then remove them
101+
npm install-scripts prune --dry-run
102+
npm install-scripts prune
103+
```
104+
105+
### Configuration
106+
107+
#### `all`
108+
109+
* Default: false
110+
* Type: Boolean
111+
112+
Show or act on all packages, not just the ones your project directly depends
113+
on. For `npm outdated` and `npm ls` this lists every outdated or installed
114+
package. For `npm approve-scripts` and `npm deny-scripts` it selects every
115+
package with pending install scripts.
116+
117+
118+
119+
#### `allow-scripts-pin`
120+
121+
* Default: true
122+
* Type: Boolean
123+
124+
Write pinned (`pkg@version`) entries when approving install scripts. Set to
125+
`false` to write name-only entries that allow any version. Has no effect on
126+
`npm deny-scripts`, which always writes name-only entries regardless of this
127+
setting.
128+
129+
130+
131+
#### `dry-run`
132+
133+
* Default: false
134+
* Type: Boolean
135+
136+
Indicates that you don't want npm to make any changes and that it should
137+
only report what it would have done. This can be passed into any of the
138+
commands that modify your local installation, eg, `install`, `update`,
139+
`dedupe`, `uninstall`, as well as `pack` and `publish`.
140+
141+
Note: This is NOT honored by other network related commands, eg `dist-tags`,
142+
`owner`, etc.
143+
144+
145+
146+
#### `json`
147+
148+
* Default: false
149+
* Type: Boolean
150+
151+
Whether or not to output JSON data, rather than the normal output.
152+
153+
* In `npm pkg set` it enables parsing set values with JSON.parse() before
154+
 saving them to your `package.json`.
155+
156+
Not supported by all npm commands.
157+
158+
159+
160+
### See Also
161+
162+
*[npm approve-scripts](/commands/npm-approve-scripts)
163+
*[npm deny-scripts](/commands/npm-deny-scripts)
164+
*[npm install](/commands/npm-install)
165+
*[npm rebuild](/commands/npm-rebuild)
166+
*[package.json](/configuring-npm/package-json)
‎deps/npm/docs/content/commands/npm-install-test.md‎
Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,16 @@ Sets the strategy for installing packages in node_modules. hoisted
6868
(default): Install non-duplicated in top-level, and duplicated as necessary
6969
within directory structure. nested: (formerly --legacy-bundling) install in
7070
place, no hoisting. shallow (formerly --global-style) only install direct
71-
deps at top-level. linked: (experimental) install in node_modules/.store,
72-
link in place, unhoisted.
71+
deps at top-level. linked: install in node_modules/.store, link in place,
72+
unhoisted.
73+
74+
We recommend that package authors use `--install-strategy=linked` during
75+
development to catch undeclared ("phantom") dependencies before publishing:
76+
the isolated layout only exposes a package's declared dependencies, so an
77+
`import` of a package that was never added to `package.json` can fail
78+
instead of resolving by accident and shipping broken. See [Catching
79+
undeclared ("phantom")
80+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7381

7482

7583

@@ -328,6 +336,10 @@ silently skipped; this setting only affects unreviewed entries.
328336
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
329337
setting.
330338

339+
Optional dependencies that cannot be installed on the current platform or
340+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
341+
their install scripts never run.
342+
331343

332344

333345
#### `dangerously-allow-all-scripts`
@@ -375,6 +387,10 @@ sources, the standard precedence applies (cli > env > project > user >
375387
global), so a higher-priority source can always relax or override a
376388
lower-priority one.
377389

390+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
391+
fix` would install, npm keeps the vulnerable version, warns, and exits with
392+
a non-zero code.
393+
378394
Packages whose names match `min-release-age-exclude` are exempt from this
379395
filter.
380396

@@ -397,6 +413,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
397413
apply, `before` wins within a single source and across sources the standard
398414
precedence rules apply.
399415

416+
When this window stops `npm audit fix` from installing a patched version
417+
(because the fix was published too recently), npm keeps the package at its
418+
vulnerable version, warns that the fix was blocked, and exits with a
419+
non-zero code. To install the fix, add the package to
420+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
421+
400422
Packages whose names match `min-release-age-exclude` are exempt from this
401423
filter.
402424

‎deps/npm/docs/content/commands/npm-install.md‎
Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -410,8 +410,16 @@ Sets the strategy for installing packages in node_modules. hoisted
410410
(default): Install non-duplicated in top-level, and duplicated as necessary
411411
within directory structure. nested: (formerly --legacy-bundling) install in
412412
place, no hoisting. shallow (formerly --global-style) only install direct
413-
deps at top-level. linked: (experimental) install in node_modules/.store,
414-
link in place, unhoisted.
413+
deps at top-level. linked: install in node_modules/.store, link in place,
414+
unhoisted.
415+
416+
We recommend that package authors use `--install-strategy=linked` during
417+
development to catch undeclared ("phantom") dependencies before publishing:
418+
the isolated layout only exposes a package's declared dependencies, so an
419+
`import` of a package that was never added to `package.json` can fail
420+
instead of resolving by accident and shipping broken. See [Catching
421+
undeclared ("phantom")
422+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
415423

416424

417425

@@ -670,6 +678,10 @@ silently skipped; this setting only affects unreviewed entries.
670678
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
671679
setting.
672680
681+
Optional dependencies that cannot be installed on the current platform or
682+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
683+
their install scripts never run.
684+
673685
674686
675687
#### `dangerously-allow-all-scripts`
@@ -717,6 +729,10 @@ sources, the standard precedence applies (cli > env > project > user >
717729
global), so a higher-priority source can always relax or override a
718730
lower-priority one.
719731
732+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
733+
fix` would install, npm keeps the vulnerable version, warns, and exits with
734+
a non-zero code.
735+
720736
Packages whose names match `min-release-age-exclude` are exempt from this
721737
filter.
722738
@@ -739,6 +755,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
739755
apply, `before` wins within a single source and across sources the standard
740756
precedence rules apply.
741757
758+
When this window stops `npm audit fix` from installing a patched version
759+
(because the fix was published too recently), npm keeps the package at its
760+
vulnerable version, warns that the fix was blocked, and exits with a
761+
non-zero code. To install the fix, add the package to
762+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
763+
742764
Packages whose names match `min-release-age-exclude` are exempt from this
743765
filter.
744766
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit 7ac97fc
Browse files
npm-cli-botaduh95
npm-cli-bot
authored and
aduh95
committed
deps: upgrade npm to 11.18.0
PR-URL: #64199
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
1 parent 2ef4b7e commit 7ac97fc
293 files changed
Lines changed: 3844 additions & 723 deletions
File tree
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
‎deps/npm/docs/content/commands/npm-approve-scripts.md‎
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ the command cannot infer. Existing `false` entries always win;
5959
`approve-scripts` will not silently re-allow a package you previously
6060
denied.
6161

62+
If a registry dependency has no `resolved` URL in your `package-lock.json`
63+
(for example, an older lockfile or one written with
64+
`omit-lockfile-registry-resolved`), npm cannot verify a trusted version for
65+
it and cannot pin it: a `pkg@1.2.3` entry never matches, so the package
66+
keeps appearing under `--allow-scripts-pending`. `approve-scripts` approves
67+
these by name (`pkg: true`) and warns when it does. To restore pinning,
68+
refresh the lockfile with `npm install`.
69+
6270
### Examples
6371

6472
```bash
‎deps/npm/docs/content/commands/npm-ci.md‎
Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987

8088

8189

@@ -298,6 +306,10 @@ silently skipped; this setting only affects unreviewed entries.
298306
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
299307
setting.
300308

309+
Optional dependencies that cannot be installed on the current platform or
310+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
311+
their install scripts never run.
312+
301313

302314

303315
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-dedupe.md‎
Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987
8088
8189
‎deps/npm/docs/content/commands/npm-exec.md‎
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,10 @@ silently skipped; this setting only affects unreviewed entries.
194194
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
195195
setting.
196196

197+
Optional dependencies that cannot be installed on the current platform or
198+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
199+
their install scripts never run.
200+
197201

198202

199203
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-find-dupes.md‎
Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2525
(default): Install non-duplicated in top-level, and duplicated as necessary
2626
within directory structure. nested: (formerly --legacy-bundling) install in
2727
place, no hoisting. shallow (formerly --global-style) only install direct
28-
deps at top-level. linked: (experimental) install in node_modules/.store,
29-
link in place, unhoisted.
28+
deps at top-level. linked: install in node_modules/.store, link in place,
29+
unhoisted.
30+
31+
We recommend that package authors use `--install-strategy=linked` during
32+
development to catch undeclared ("phantom") dependencies before publishing:
33+
the isolated layout only exposes a package's declared dependencies, so an
34+
`import` of a package that was never added to `package.json` can fail
35+
instead of resolving by accident and shipping broken. See [Catching
36+
undeclared ("phantom")
37+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3038

3139

3240

‎deps/npm/docs/content/commands/npm-install-ci-test.md‎
Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2727
(default): Install non-duplicated in top-level, and duplicated as necessary
2828
within directory structure. nested: (formerly --legacy-bundling) install in
2929
place, no hoisting. shallow (formerly --global-style) only install direct
30-
deps at top-level. linked: (experimental) install in node_modules/.store,
31-
link in place, unhoisted.
30+
deps at top-level. linked: install in node_modules/.store, link in place,
31+
unhoisted.
32+
33+
We recommend that package authors use `--install-strategy=linked` during
34+
development to catch undeclared ("phantom") dependencies before publishing:
35+
the isolated layout only exposes a package's declared dependencies, so an
36+
`import` of a package that was never added to `package.json` can fail
37+
instead of resolving by accident and shipping broken. See [Catching
38+
undeclared ("phantom")
39+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3240

3341

3442

@@ -251,6 +259,10 @@ silently skipped; this setting only affects unreviewed entries.
251259
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
252260
setting.
253261

262+
Optional dependencies that cannot be installed on the current platform or
263+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
264+
their install scripts never run.
265+
254266

255267

256268
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-install-scripts.md‎
Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
---
2+
title: npm-install-scripts
3+
section: 1
4+
description: Manage install-script approvals for dependencies
5+
---
6+
7+
### Synopsis
8+
9+
```bash
10+
npm install-scripts approve <pkg> [<pkg> ...]
11+
npm install-scripts approve --all
12+
npm install-scripts deny <pkg> [<pkg> ...]
13+
npm install-scripts deny --all
14+
npm install-scripts ls
15+
npm install-scripts prune
16+
```
17+
18+
Note: This command is unaware of workspaces.
19+
20+
### Description
21+
22+
Manages the `allowScripts` field in your project's `package.json`, which
23+
records which of your dependencies are permitted to run install scripts
24+
(`preinstall`, `install`, `postinstall`, and `prepare` for non-registry
25+
sources). This is the recommended way to maintain that field.
26+
27+
Dependency install scripts are blocked by default. Install commands
28+
silently skip lifecycle scripts for any dependency that does not have a
29+
matching entry in `allowScripts`, and end with a list of the packages
30+
whose scripts were skipped so you can review them here.
31+
32+
This command only works inside a project that has a `package.json`. Running
33+
it with `--global` (`-g`) fails with an `EGLOBAL` error, since global
34+
installs (`npm install -g`) and one-off executions (`npm exec` / `npx`) have
35+
no project `package.json` to write to. To allow install scripts in those
36+
contexts, use the `--allow-scripts` flag at install time (for example
37+
`npm install -g --allow-scripts=canvas,sharp`) or persist the setting with
38+
`npm config set allow-scripts=canvas,sharp --location=user`.
39+
40+
There are four subcommands:
41+
42+
```bash
43+
npm install-scripts approve <pkg> [<pkg> ...]
44+
npm install-scripts approve --all
45+
npm install-scripts deny <pkg> [<pkg> ...]
46+
npm install-scripts deny --all
47+
npm install-scripts ls
48+
npm install-scripts prune
49+
```
50+
51+
`approve` allows install scripts for the named packages. `<pkg>` matches
52+
every installed version of that package. By default it writes pinned entries
53+
(`pkg@1.2.3`), which keep their approval narrowed to the specific version you
54+
reviewed. Pass `--no-allow-scripts-pin` to write name-only entries that allow
55+
any future version. `--all` approves every package with unreviewed install
56+
scripts in one go.
57+
58+
`deny` records an explicit denial for the named packages (a name-only `false`
59+
entry), which survives `npm install-scripts approve --all` and excludes the
60+
package from any future blanket approval. `--all` denies every package with
61+
unreviewed install scripts.
62+
63+
`ls` is read-only: it lists every package whose install scripts are not yet
64+
covered by `allowScripts`, without modifying `package.json`.
65+
66+
`prune` removes `allowScripts` entries that no longer match an installed
67+
package with an install script, either because the package is no longer
68+
installed (a transitive dependency changed, or a pinned `pkg@1.2.3` was
69+
upgraded) or because it no longer has an install script. Both approvals
70+
(`true`) and denials (`false`) are removed. It edits only the `allowScripts`
71+
field in `package.json`, never `.npmrc` or `--allow-scripts`. Pass `--dry-run`
72+
to preview without writing. Unparseable keys are left alone.
73+
74+
`approve` honours the asymmetric pin rule: if you re-approve a package whose
75+
installed version has changed, the existing pin is rewritten to track the new
76+
installed version. Multi-version statements (`pkg@1 || 2`) are left alone,
77+
since they likely capture intent that the command cannot infer. Existing
78+
`false` entries always win; `approve` will not silently re-allow a package you
79+
previously denied.
80+
81+
The standalone commands [`npm approve-scripts`](/commands/npm-approve-scripts)
82+
and [`npm deny-scripts`](/commands/npm-deny-scripts) are aliases for
83+
`npm install-scripts approve` and `npm install-scripts deny`.
84+
85+
### Examples
86+
87+
```bash
88+
# Approve all currently-installed install scripts after reviewing them
89+
npm install-scripts approve --all
90+
91+
# Approve specific packages, pinned to their installed version
92+
npm install-scripts approve canvas sharp
93+
94+
# Deny a package so it stays blocked
95+
npm install-scripts deny telemetry-pkg
96+
97+
# Preview which packages still need review
98+
npm install-scripts ls
99+
100+
# Preview stale allowScripts entries, then remove them
101+
npm install-scripts prune --dry-run
102+
npm install-scripts prune
103+
```
104+
105+
### Configuration
106+
107+
#### `all`
108+
109+
* Default: false
110+
* Type: Boolean
111+
112+
Show or act on all packages, not just the ones your project directly depends
113+
on. For `npm outdated` and `npm ls` this lists every outdated or installed
114+
package. For `npm approve-scripts` and `npm deny-scripts` it selects every
115+
package with pending install scripts.
116+
117+
118+
119+
#### `allow-scripts-pin`
120+
121+
* Default: true
122+
* Type: Boolean
123+
124+
Write pinned (`pkg@version`) entries when approving install scripts. Set to
125+
`false` to write name-only entries that allow any version. Has no effect on
126+
`npm deny-scripts`, which always writes name-only entries regardless of this
127+
setting.
128+
129+
130+
131+
#### `dry-run`
132+
133+
* Default: false
134+
* Type: Boolean
135+
136+
Indicates that you don't want npm to make any changes and that it should
137+
only report what it would have done. This can be passed into any of the
138+
commands that modify your local installation, eg, `install`, `update`,
139+
`dedupe`, `uninstall`, as well as `pack` and `publish`.
140+
141+
Note: This is NOT honored by other network related commands, eg `dist-tags`,
142+
`owner`, etc.
143+
144+
145+
146+
#### `json`
147+
148+
* Default: false
149+
* Type: Boolean
150+
151+
Whether or not to output JSON data, rather than the normal output.
152+
153+
* In `npm pkg set` it enables parsing set values with JSON.parse() before
154+
 saving them to your `package.json`.
155+
156+
Not supported by all npm commands.
157+
158+
159+
160+
### See Also
161+
162+
*[npm approve-scripts](/commands/npm-approve-scripts)
163+
*[npm deny-scripts](/commands/npm-deny-scripts)
164+
*[npm install](/commands/npm-install)
165+
*[npm rebuild](/commands/npm-rebuild)
166+
*[package.json](/configuring-npm/package-json)
‎deps/npm/docs/content/commands/npm-install-test.md‎
Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,16 @@ Sets the strategy for installing packages in node_modules. hoisted
6868
(default): Install non-duplicated in top-level, and duplicated as necessary
6969
within directory structure. nested: (formerly --legacy-bundling) install in
7070
place, no hoisting. shallow (formerly --global-style) only install direct
71-
deps at top-level. linked: (experimental) install in node_modules/.store,
72-
link in place, unhoisted.
71+
deps at top-level. linked: install in node_modules/.store, link in place,
72+
unhoisted.
73+
74+
We recommend that package authors use `--install-strategy=linked` during
75+
development to catch undeclared ("phantom") dependencies before publishing:
76+
the isolated layout only exposes a package's declared dependencies, so an
77+
`import` of a package that was never added to `package.json` can fail
78+
instead of resolving by accident and shipping broken. See [Catching
79+
undeclared ("phantom")
80+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7381

7482

7583

@@ -328,6 +336,10 @@ silently skipped; this setting only affects unreviewed entries.
328336
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
329337
setting.
330338

339+
Optional dependencies that cannot be installed on the current platform or
340+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
341+
their install scripts never run.
342+
331343

332344

333345
#### `dangerously-allow-all-scripts`
@@ -375,6 +387,10 @@ sources, the standard precedence applies (cli > env > project > user >
375387
global), so a higher-priority source can always relax or override a
376388
lower-priority one.
377389

390+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
391+
fix` would install, npm keeps the vulnerable version, warns, and exits with
392+
a non-zero code.
393+
378394
Packages whose names match `min-release-age-exclude` are exempt from this
379395
filter.
380396

@@ -397,6 +413,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
397413
apply, `before` wins within a single source and across sources the standard
398414
precedence rules apply.
399415

416+
When this window stops `npm audit fix` from installing a patched version
417+
(because the fix was published too recently), npm keeps the package at its
418+
vulnerable version, warns that the fix was blocked, and exits with a
419+
non-zero code. To install the fix, add the package to
420+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
421+
400422
Packages whose names match `min-release-age-exclude` are exempt from this
401423
filter.
402424

‎deps/npm/docs/content/commands/npm-install.md‎
Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -410,8 +410,16 @@ Sets the strategy for installing packages in node_modules. hoisted
410410
(default): Install non-duplicated in top-level, and duplicated as necessary
411411
within directory structure. nested: (formerly --legacy-bundling) install in
412412
place, no hoisting. shallow (formerly --global-style) only install direct
413-
deps at top-level. linked: (experimental) install in node_modules/.store,
414-
link in place, unhoisted.
413+
deps at top-level. linked: install in node_modules/.store, link in place,
414+
unhoisted.
415+
416+
We recommend that package authors use `--install-strategy=linked` during
417+
development to catch undeclared ("phantom") dependencies before publishing:
418+
the isolated layout only exposes a package's declared dependencies, so an
419+
`import` of a package that was never added to `package.json` can fail
420+
instead of resolving by accident and shipping broken. See [Catching
421+
undeclared ("phantom")
422+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
415423

416424

417425

@@ -670,6 +678,10 @@ silently skipped; this setting only affects unreviewed entries.
670678
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
671679
setting.
672680
681+
Optional dependencies that cannot be installed on the current platform or
682+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
683+
their install scripts never run.
684+
673685
674686
675687
#### `dangerously-allow-all-scripts`
@@ -717,6 +729,10 @@ sources, the standard precedence applies (cli > env > project > user >
717729
global), so a higher-priority source can always relax or override a
718730
lower-priority one.
719731
732+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
733+
fix` would install, npm keeps the vulnerable version, warns, and exits with
734+
a non-zero code.
735+
720736
Packages whose names match `min-release-age-exclude` are exempt from this
721737
filter.
722738
@@ -739,6 +755,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
739755
apply, `before` wins within a single source and across sources the standard
740756
precedence rules apply.
741757
758+
When this window stops `npm audit fix` from installing a patched version
759+
(because the fix was published too recently), npm keeps the package at its
760+
vulnerable version, warns that the fix was blocked, and exits with a
761+
non-zero code. To install the fix, add the package to
762+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
763+
742764
Packages whose names match `min-release-age-exclude` are exempt from this
743765
filter.
744766
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Commit 7ac97fc
Browse files
npm-cli-botaduh95
npm-cli-bot
authored and
aduh95
committed
deps: upgrade npm to 11.18.0
PR-URL: #64199
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
1 parent 2ef4b7e commit 7ac97fc
293 files changed
Lines changed: 3844 additions & 723 deletions
File tree
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
‎deps/npm/docs/content/commands/npm-approve-scripts.md‎
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ the command cannot infer. Existing `false` entries always win;
5959
`approve-scripts` will not silently re-allow a package you previously
6060
denied.
6161

62+
If a registry dependency has no `resolved` URL in your `package-lock.json`
63+
(for example, an older lockfile or one written with
64+
`omit-lockfile-registry-resolved`), npm cannot verify a trusted version for
65+
it and cannot pin it: a `pkg@1.2.3` entry never matches, so the package
66+
keeps appearing under `--allow-scripts-pending`. `approve-scripts` approves
67+
these by name (`pkg: true`) and warns when it does. To restore pinning,
68+
refresh the lockfile with `npm install`.
69+
6270
### Examples
6371

6472
```bash
‎deps/npm/docs/content/commands/npm-ci.md‎
Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987

8088

8189

@@ -298,6 +306,10 @@ silently skipped; this setting only affects unreviewed entries.
298306
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
299307
setting.
300308

309+
Optional dependencies that cannot be installed on the current platform or
310+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
311+
their install scripts never run.
312+
301313

302314

303315
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-dedupe.md‎
Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987
8088
8189
‎deps/npm/docs/content/commands/npm-exec.md‎
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,10 @@ silently skipped; this setting only affects unreviewed entries.
194194
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
195195
setting.
196196

197+
Optional dependencies that cannot be installed on the current platform or
198+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
199+
their install scripts never run.
200+
197201

198202

199203
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-find-dupes.md‎
Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2525
(default): Install non-duplicated in top-level, and duplicated as necessary
2626
within directory structure. nested: (formerly --legacy-bundling) install in
2727
place, no hoisting. shallow (formerly --global-style) only install direct
28-
deps at top-level. linked: (experimental) install in node_modules/.store,
29-
link in place, unhoisted.
28+
deps at top-level. linked: install in node_modules/.store, link in place,
29+
unhoisted.
30+
31+
We recommend that package authors use `--install-strategy=linked` during
32+
development to catch undeclared ("phantom") dependencies before publishing:
33+
the isolated layout only exposes a package's declared dependencies, so an
34+
`import` of a package that was never added to `package.json` can fail
35+
instead of resolving by accident and shipping broken. See [Catching
36+
undeclared ("phantom")
37+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3038

3139

3240

‎deps/npm/docs/content/commands/npm-install-ci-test.md‎
Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2727
(default): Install non-duplicated in top-level, and duplicated as necessary
2828
within directory structure. nested: (formerly --legacy-bundling) install in
2929
place, no hoisting. shallow (formerly --global-style) only install direct
30-
deps at top-level. linked: (experimental) install in node_modules/.store,
31-
link in place, unhoisted.
30+
deps at top-level. linked: install in node_modules/.store, link in place,
31+
unhoisted.
32+
33+
We recommend that package authors use `--install-strategy=linked` during
34+
development to catch undeclared ("phantom") dependencies before publishing:
35+
the isolated layout only exposes a package's declared dependencies, so an
36+
`import` of a package that was never added to `package.json` can fail
37+
instead of resolving by accident and shipping broken. See [Catching
38+
undeclared ("phantom")
39+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3240

3341

3442

@@ -251,6 +259,10 @@ silently skipped; this setting only affects unreviewed entries.
251259
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
252260
setting.
253261

262+
Optional dependencies that cannot be installed on the current platform or
263+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
264+
their install scripts never run.
265+
254266

255267

256268
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-install-scripts.md‎
Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
---
2+
title: npm-install-scripts
3+
section: 1
4+
description: Manage install-script approvals for dependencies
5+
---
6+
7+
### Synopsis
8+
9+
```bash
10+
npm install-scripts approve <pkg> [<pkg> ...]
11+
npm install-scripts approve --all
12+
npm install-scripts deny <pkg> [<pkg> ...]
13+
npm install-scripts deny --all
14+
npm install-scripts ls
15+
npm install-scripts prune
16+
```
17+
18+
Note: This command is unaware of workspaces.
19+
20+
### Description
21+
22+
Manages the `allowScripts` field in your project's `package.json`, which
23+
records which of your dependencies are permitted to run install scripts
24+
(`preinstall`, `install`, `postinstall`, and `prepare` for non-registry
25+
sources). This is the recommended way to maintain that field.
26+
27+
Dependency install scripts are blocked by default. Install commands
28+
silently skip lifecycle scripts for any dependency that does not have a
29+
matching entry in `allowScripts`, and end with a list of the packages
30+
whose scripts were skipped so you can review them here.
31+
32+
This command only works inside a project that has a `package.json`. Running
33+
it with `--global` (`-g`) fails with an `EGLOBAL` error, since global
34+
installs (`npm install -g`) and one-off executions (`npm exec` / `npx`) have
35+
no project `package.json` to write to. To allow install scripts in those
36+
contexts, use the `--allow-scripts` flag at install time (for example
37+
`npm install -g --allow-scripts=canvas,sharp`) or persist the setting with
38+
`npm config set allow-scripts=canvas,sharp --location=user`.
39+
40+
There are four subcommands:
41+
42+
```bash
43+
npm install-scripts approve <pkg> [<pkg> ...]
44+
npm install-scripts approve --all
45+
npm install-scripts deny <pkg> [<pkg> ...]
46+
npm install-scripts deny --all
47+
npm install-scripts ls
48+
npm install-scripts prune
49+
```
50+
51+
`approve` allows install scripts for the named packages. `<pkg>` matches
52+
every installed version of that package. By default it writes pinned entries
53+
(`pkg@1.2.3`), which keep their approval narrowed to the specific version you
54+
reviewed. Pass `--no-allow-scripts-pin` to write name-only entries that allow
55+
any future version. `--all` approves every package with unreviewed install
56+
scripts in one go.
57+
58+
`deny` records an explicit denial for the named packages (a name-only `false`
59+
entry), which survives `npm install-scripts approve --all` and excludes the
60+
package from any future blanket approval. `--all` denies every package with
61+
unreviewed install scripts.
62+
63+
`ls` is read-only: it lists every package whose install scripts are not yet
64+
covered by `allowScripts`, without modifying `package.json`.
65+
66+
`prune` removes `allowScripts` entries that no longer match an installed
67+
package with an install script, either because the package is no longer
68+
installed (a transitive dependency changed, or a pinned `pkg@1.2.3` was
69+
upgraded) or because it no longer has an install script. Both approvals
70+
(`true`) and denials (`false`) are removed. It edits only the `allowScripts`
71+
field in `package.json`, never `.npmrc` or `--allow-scripts`. Pass `--dry-run`
72+
to preview without writing. Unparseable keys are left alone.
73+
74+
`approve` honours the asymmetric pin rule: if you re-approve a package whose
75+
installed version has changed, the existing pin is rewritten to track the new
76+
installed version. Multi-version statements (`pkg@1 || 2`) are left alone,
77+
since they likely capture intent that the command cannot infer. Existing
78+
`false` entries always win; `approve` will not silently re-allow a package you
79+
previously denied.
80+
81+
The standalone commands [`npm approve-scripts`](/commands/npm-approve-scripts)
82+
and [`npm deny-scripts`](/commands/npm-deny-scripts) are aliases for
83+
`npm install-scripts approve` and `npm install-scripts deny`.
84+
85+
### Examples
86+
87+
```bash
88+
# Approve all currently-installed install scripts after reviewing them
89+
npm install-scripts approve --all
90+
91+
# Approve specific packages, pinned to their installed version
92+
npm install-scripts approve canvas sharp
93+
94+
# Deny a package so it stays blocked
95+
npm install-scripts deny telemetry-pkg
96+
97+
# Preview which packages still need review
98+
npm install-scripts ls
99+
100+
# Preview stale allowScripts entries, then remove them
101+
npm install-scripts prune --dry-run
102+
npm install-scripts prune
103+
```
104+
105+
### Configuration
106+
107+
#### `all`
108+
109+
* Default: false
110+
* Type: Boolean
111+
112+
Show or act on all packages, not just the ones your project directly depends
113+
on. For `npm outdated` and `npm ls` this lists every outdated or installed
114+
package. For `npm approve-scripts` and `npm deny-scripts` it selects every
115+
package with pending install scripts.
116+
117+
118+
119+
#### `allow-scripts-pin`
120+
121+
* Default: true
122+
* Type: Boolean
123+
124+
Write pinned (`pkg@version`) entries when approving install scripts. Set to
125+
`false` to write name-only entries that allow any version. Has no effect on
126+
`npm deny-scripts`, which always writes name-only entries regardless of this
127+
setting.
128+
129+
130+
131+
#### `dry-run`
132+
133+
* Default: false
134+
* Type: Boolean
135+
136+
Indicates that you don't want npm to make any changes and that it should
137+
only report what it would have done. This can be passed into any of the
138+
commands that modify your local installation, eg, `install`, `update`,
139+
`dedupe`, `uninstall`, as well as `pack` and `publish`.
140+
141+
Note: This is NOT honored by other network related commands, eg `dist-tags`,
142+
`owner`, etc.
143+
144+
145+
146+
#### `json`
147+
148+
* Default: false
149+
* Type: Boolean
150+
151+
Whether or not to output JSON data, rather than the normal output.
152+
153+
* In `npm pkg set` it enables parsing set values with JSON.parse() before
154+
 saving them to your `package.json`.
155+
156+
Not supported by all npm commands.
157+
158+
159+
160+
### See Also
161+
162+
*[npm approve-scripts](/commands/npm-approve-scripts)
163+
*[npm deny-scripts](/commands/npm-deny-scripts)
164+
*[npm install](/commands/npm-install)
165+
*[npm rebuild](/commands/npm-rebuild)
166+
*[package.json](/configuring-npm/package-json)
‎deps/npm/docs/content/commands/npm-install-test.md‎
Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,16 @@ Sets the strategy for installing packages in node_modules. hoisted
6868
(default): Install non-duplicated in top-level, and duplicated as necessary
6969
within directory structure. nested: (formerly --legacy-bundling) install in
7070
place, no hoisting. shallow (formerly --global-style) only install direct
71-
deps at top-level. linked: (experimental) install in node_modules/.store,
72-
link in place, unhoisted.
71+
deps at top-level. linked: install in node_modules/.store, link in place,
72+
unhoisted.
73+
74+
We recommend that package authors use `--install-strategy=linked` during
75+
development to catch undeclared ("phantom") dependencies before publishing:
76+
the isolated layout only exposes a package's declared dependencies, so an
77+
`import` of a package that was never added to `package.json` can fail
78+
instead of resolving by accident and shipping broken. See [Catching
79+
undeclared ("phantom")
80+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7381

7482

7583

@@ -328,6 +336,10 @@ silently skipped; this setting only affects unreviewed entries.
328336
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
329337
setting.
330338

339+
Optional dependencies that cannot be installed on the current platform or
340+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
341+
their install scripts never run.
342+
331343

332344

333345
#### `dangerously-allow-all-scripts`
@@ -375,6 +387,10 @@ sources, the standard precedence applies (cli > env > project > user >
375387
global), so a higher-priority source can always relax or override a
376388
lower-priority one.
377389

390+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
391+
fix` would install, npm keeps the vulnerable version, warns, and exits with
392+
a non-zero code.
393+
378394
Packages whose names match `min-release-age-exclude` are exempt from this
379395
filter.
380396

@@ -397,6 +413,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
397413
apply, `before` wins within a single source and across sources the standard
398414
precedence rules apply.
399415

416+
When this window stops `npm audit fix` from installing a patched version
417+
(because the fix was published too recently), npm keeps the package at its
418+
vulnerable version, warns that the fix was blocked, and exits with a
419+
non-zero code. To install the fix, add the package to
420+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
421+
400422
Packages whose names match `min-release-age-exclude` are exempt from this
401423
filter.
402424

‎deps/npm/docs/content/commands/npm-install.md‎
Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -410,8 +410,16 @@ Sets the strategy for installing packages in node_modules. hoisted
410410
(default): Install non-duplicated in top-level, and duplicated as necessary
411411
within directory structure. nested: (formerly --legacy-bundling) install in
412412
place, no hoisting. shallow (formerly --global-style) only install direct
413-
deps at top-level. linked: (experimental) install in node_modules/.store,
414-
link in place, unhoisted.
413+
deps at top-level. linked: install in node_modules/.store, link in place,
414+
unhoisted.
415+
416+
We recommend that package authors use `--install-strategy=linked` during
417+
development to catch undeclared ("phantom") dependencies before publishing:
418+
the isolated layout only exposes a package's declared dependencies, so an
419+
`import` of a package that was never added to `package.json` can fail
420+
instead of resolving by accident and shipping broken. See [Catching
421+
undeclared ("phantom")
422+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
415423

416424

417425

@@ -670,6 +678,10 @@ silently skipped; this setting only affects unreviewed entries.
670678
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
671679
setting.
672680
681+
Optional dependencies that cannot be installed on the current platform or
682+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
683+
their install scripts never run.
684+
673685
674686
675687
#### `dangerously-allow-all-scripts`
@@ -717,6 +729,10 @@ sources, the standard precedence applies (cli > env > project > user >
717729
global), so a higher-priority source can always relax or override a
718730
lower-priority one.
719731
732+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
733+
fix` would install, npm keeps the vulnerable version, warns, and exits with
734+
a non-zero code.
735+
720736
Packages whose names match `min-release-age-exclude` are exempt from this
721737
filter.
722738
@@ -739,6 +755,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
739755
apply, `before` wins within a single source and across sources the standard
740756
precedence rules apply.
741757
758+
When this window stops `npm audit fix` from installing a patched version
759+
(because the fix was published too recently), npm keeps the package at its
760+
vulnerable version, warns that the fix was blocked, and exits with a
761+
non-zero code. To install the fix, add the package to
762+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
763+
742764
Packages whose names match `min-release-age-exclude` are exempt from this
743765
filter.
744766
0 commit comments
Comments
 (0)

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Commit 7ac97fc
Browse files
npm-cli-botaduh95
npm-cli-bot
authored and
aduh95
committed
deps: upgrade npm to 11.18.0
PR-URL: #64199
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
1 parent 2ef4b7e commit 7ac97fc
293 files changed
Lines changed: 3844 additions & 723 deletions
File tree
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
‎deps/npm/docs/content/commands/npm-approve-scripts.md‎
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ the command cannot infer. Existing `false` entries always win;
5959
`approve-scripts` will not silently re-allow a package you previously
6060
denied.
6161

62+
If a registry dependency has no `resolved` URL in your `package-lock.json`
63+
(for example, an older lockfile or one written with
64+
`omit-lockfile-registry-resolved`), npm cannot verify a trusted version for
65+
it and cannot pin it: a `pkg@1.2.3` entry never matches, so the package
66+
keeps appearing under `--allow-scripts-pending`. `approve-scripts` approves
67+
these by name (`pkg: true`) and warns when it does. To restore pinning,
68+
refresh the lockfile with `npm install`.
69+
6270
### Examples
6371

6472
```bash
‎deps/npm/docs/content/commands/npm-ci.md‎
Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987

8088

8189

@@ -298,6 +306,10 @@ silently skipped; this setting only affects unreviewed entries.
298306
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
299307
setting.
300308

309+
Optional dependencies that cannot be installed on the current platform or
310+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
311+
their install scripts never run.
312+
301313

302314

303315
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-dedupe.md‎
Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,16 @@ Sets the strategy for installing packages in node_modules. hoisted
7474
(default): Install non-duplicated in top-level, and duplicated as necessary
7575
within directory structure. nested: (formerly --legacy-bundling) install in
7676
place, no hoisting. shallow (formerly --global-style) only install direct
77-
deps at top-level. linked: (experimental) install in node_modules/.store,
78-
link in place, unhoisted.
77+
deps at top-level. linked: install in node_modules/.store, link in place,
78+
unhoisted.
79+
80+
We recommend that package authors use `--install-strategy=linked` during
81+
development to catch undeclared ("phantom") dependencies before publishing:
82+
the isolated layout only exposes a package's declared dependencies, so an
83+
`import` of a package that was never added to `package.json` can fail
84+
instead of resolving by accident and shipping broken. See [Catching
85+
undeclared ("phantom")
86+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7987
8088
8189
‎deps/npm/docs/content/commands/npm-exec.md‎
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,10 @@ silently skipped; this setting only affects unreviewed entries.
194194
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
195195
setting.
196196

197+
Optional dependencies that cannot be installed on the current platform or
198+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
199+
their install scripts never run.
200+
197201

198202

199203
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-find-dupes.md‎
Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2525
(default): Install non-duplicated in top-level, and duplicated as necessary
2626
within directory structure. nested: (formerly --legacy-bundling) install in
2727
place, no hoisting. shallow (formerly --global-style) only install direct
28-
deps at top-level. linked: (experimental) install in node_modules/.store,
29-
link in place, unhoisted.
28+
deps at top-level. linked: install in node_modules/.store, link in place,
29+
unhoisted.
30+
31+
We recommend that package authors use `--install-strategy=linked` during
32+
development to catch undeclared ("phantom") dependencies before publishing:
33+
the isolated layout only exposes a package's declared dependencies, so an
34+
`import` of a package that was never added to `package.json` can fail
35+
instead of resolving by accident and shipping broken. See [Catching
36+
undeclared ("phantom")
37+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3038

3139

3240

‎deps/npm/docs/content/commands/npm-install-ci-test.md‎
Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,16 @@ Sets the strategy for installing packages in node_modules. hoisted
2727
(default): Install non-duplicated in top-level, and duplicated as necessary
2828
within directory structure. nested: (formerly --legacy-bundling) install in
2929
place, no hoisting. shallow (formerly --global-style) only install direct
30-
deps at top-level. linked: (experimental) install in node_modules/.store,
31-
link in place, unhoisted.
30+
deps at top-level. linked: install in node_modules/.store, link in place,
31+
unhoisted.
32+
33+
We recommend that package authors use `--install-strategy=linked` during
34+
development to catch undeclared ("phantom") dependencies before publishing:
35+
the isolated layout only exposes a package's declared dependencies, so an
36+
`import` of a package that was never added to `package.json` can fail
37+
instead of resolving by accident and shipping broken. See [Catching
38+
undeclared ("phantom")
39+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
3240

3341

3442

@@ -251,6 +259,10 @@ silently skipped; this setting only affects unreviewed entries.
251259
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
252260
setting.
253261

262+
Optional dependencies that cannot be installed on the current platform or
263+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
264+
their install scripts never run.
265+
254266

255267

256268
#### `dangerously-allow-all-scripts`
‎deps/npm/docs/content/commands/npm-install-scripts.md‎
Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
---
2+
title: npm-install-scripts
3+
section: 1
4+
description: Manage install-script approvals for dependencies
5+
---
6+
7+
### Synopsis
8+
9+
```bash
10+
npm install-scripts approve <pkg> [<pkg> ...]
11+
npm install-scripts approve --all
12+
npm install-scripts deny <pkg> [<pkg> ...]
13+
npm install-scripts deny --all
14+
npm install-scripts ls
15+
npm install-scripts prune
16+
```
17+
18+
Note: This command is unaware of workspaces.
19+
20+
### Description
21+
22+
Manages the `allowScripts` field in your project's `package.json`, which
23+
records which of your dependencies are permitted to run install scripts
24+
(`preinstall`, `install`, `postinstall`, and `prepare` for non-registry
25+
sources). This is the recommended way to maintain that field.
26+
27+
Dependency install scripts are blocked by default. Install commands
28+
silently skip lifecycle scripts for any dependency that does not have a
29+
matching entry in `allowScripts`, and end with a list of the packages
30+
whose scripts were skipped so you can review them here.
31+
32+
This command only works inside a project that has a `package.json`. Running
33+
it with `--global` (`-g`) fails with an `EGLOBAL` error, since global
34+
installs (`npm install -g`) and one-off executions (`npm exec` / `npx`) have
35+
no project `package.json` to write to. To allow install scripts in those
36+
contexts, use the `--allow-scripts` flag at install time (for example
37+
`npm install -g --allow-scripts=canvas,sharp`) or persist the setting with
38+
`npm config set allow-scripts=canvas,sharp --location=user`.
39+
40+
There are four subcommands:
41+
42+
```bash
43+
npm install-scripts approve <pkg> [<pkg> ...]
44+
npm install-scripts approve --all
45+
npm install-scripts deny <pkg> [<pkg> ...]
46+
npm install-scripts deny --all
47+
npm install-scripts ls
48+
npm install-scripts prune
49+
```
50+
51+
`approve` allows install scripts for the named packages. `<pkg>` matches
52+
every installed version of that package. By default it writes pinned entries
53+
(`pkg@1.2.3`), which keep their approval narrowed to the specific version you
54+
reviewed. Pass `--no-allow-scripts-pin` to write name-only entries that allow
55+
any future version. `--all` approves every package with unreviewed install
56+
scripts in one go.
57+
58+
`deny` records an explicit denial for the named packages (a name-only `false`
59+
entry), which survives `npm install-scripts approve --all` and excludes the
60+
package from any future blanket approval. `--all` denies every package with
61+
unreviewed install scripts.
62+
63+
`ls` is read-only: it lists every package whose install scripts are not yet
64+
covered by `allowScripts`, without modifying `package.json`.
65+
66+
`prune` removes `allowScripts` entries that no longer match an installed
67+
package with an install script, either because the package is no longer
68+
installed (a transitive dependency changed, or a pinned `pkg@1.2.3` was
69+
upgraded) or because it no longer has an install script. Both approvals
70+
(`true`) and denials (`false`) are removed. It edits only the `allowScripts`
71+
field in `package.json`, never `.npmrc` or `--allow-scripts`. Pass `--dry-run`
72+
to preview without writing. Unparseable keys are left alone.
73+
74+
`approve` honours the asymmetric pin rule: if you re-approve a package whose
75+
installed version has changed, the existing pin is rewritten to track the new
76+
installed version. Multi-version statements (`pkg@1 || 2`) are left alone,
77+
since they likely capture intent that the command cannot infer. Existing
78+
`false` entries always win; `approve` will not silently re-allow a package you
79+
previously denied.
80+
81+
The standalone commands [`npm approve-scripts`](/commands/npm-approve-scripts)
82+
and [`npm deny-scripts`](/commands/npm-deny-scripts) are aliases for
83+
`npm install-scripts approve` and `npm install-scripts deny`.
84+
85+
### Examples
86+
87+
```bash
88+
# Approve all currently-installed install scripts after reviewing them
89+
npm install-scripts approve --all
90+
91+
# Approve specific packages, pinned to their installed version
92+
npm install-scripts approve canvas sharp
93+
94+
# Deny a package so it stays blocked
95+
npm install-scripts deny telemetry-pkg
96+
97+
# Preview which packages still need review
98+
npm install-scripts ls
99+
100+
# Preview stale allowScripts entries, then remove them
101+
npm install-scripts prune --dry-run
102+
npm install-scripts prune
103+
```
104+
105+
### Configuration
106+
107+
#### `all`
108+
109+
* Default: false
110+
* Type: Boolean
111+
112+
Show or act on all packages, not just the ones your project directly depends
113+
on. For `npm outdated` and `npm ls` this lists every outdated or installed
114+
package. For `npm approve-scripts` and `npm deny-scripts` it selects every
115+
package with pending install scripts.
116+
117+
118+
119+
#### `allow-scripts-pin`
120+
121+
* Default: true
122+
* Type: Boolean
123+
124+
Write pinned (`pkg@version`) entries when approving install scripts. Set to
125+
`false` to write name-only entries that allow any version. Has no effect on
126+
`npm deny-scripts`, which always writes name-only entries regardless of this
127+
setting.
128+
129+
130+
131+
#### `dry-run`
132+
133+
* Default: false
134+
* Type: Boolean
135+
136+
Indicates that you don't want npm to make any changes and that it should
137+
only report what it would have done. This can be passed into any of the
138+
commands that modify your local installation, eg, `install`, `update`,
139+
`dedupe`, `uninstall`, as well as `pack` and `publish`.
140+
141+
Note: This is NOT honored by other network related commands, eg `dist-tags`,
142+
`owner`, etc.
143+
144+
145+
146+
#### `json`
147+
148+
* Default: false
149+
* Type: Boolean
150+
151+
Whether or not to output JSON data, rather than the normal output.
152+
153+
* In `npm pkg set` it enables parsing set values with JSON.parse() before
154+
 saving them to your `package.json`.
155+
156+
Not supported by all npm commands.
157+
158+
159+
160+
### See Also
161+
162+
*[npm approve-scripts](/commands/npm-approve-scripts)
163+
*[npm deny-scripts](/commands/npm-deny-scripts)
164+
*[npm install](/commands/npm-install)
165+
*[npm rebuild](/commands/npm-rebuild)
166+
*[package.json](/configuring-npm/package-json)
‎deps/npm/docs/content/commands/npm-install-test.md‎
Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,16 @@ Sets the strategy for installing packages in node_modules. hoisted
6868
(default): Install non-duplicated in top-level, and duplicated as necessary
6969
within directory structure. nested: (formerly --legacy-bundling) install in
7070
place, no hoisting. shallow (formerly --global-style) only install direct
71-
deps at top-level. linked: (experimental) install in node_modules/.store,
72-
link in place, unhoisted.
71+
deps at top-level. linked: install in node_modules/.store, link in place,
72+
unhoisted.
73+
74+
We recommend that package authors use `--install-strategy=linked` during
75+
development to catch undeclared ("phantom") dependencies before publishing:
76+
the isolated layout only exposes a package's declared dependencies, so an
77+
`import` of a package that was never added to `package.json` can fail
78+
instead of resolving by accident and shipping broken. See [Catching
79+
undeclared ("phantom")
80+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
7381

7482

7583

@@ -328,6 +336,10 @@ silently skipped; this setting only affects unreviewed entries.
328336
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
329337
setting.
330338

339+
Optional dependencies that cannot be installed on the current platform or
340+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
341+
their install scripts never run.
342+
331343

332344

333345
#### `dangerously-allow-all-scripts`
@@ -375,6 +387,10 @@ sources, the standard precedence applies (cli > env > project > user >
375387
global), so a higher-priority source can always relax or override a
376388
lower-priority one.
377389

390+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
391+
fix` would install, npm keeps the vulnerable version, warns, and exits with
392+
a non-zero code.
393+
378394
Packages whose names match `min-release-age-exclude` are exempt from this
379395
filter.
380396

@@ -397,6 +413,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
397413
apply, `before` wins within a single source and across sources the standard
398414
precedence rules apply.
399415

416+
When this window stops `npm audit fix` from installing a patched version
417+
(because the fix was published too recently), npm keeps the package at its
418+
vulnerable version, warns that the fix was blocked, and exits with a
419+
non-zero code. To install the fix, add the package to
420+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
421+
400422
Packages whose names match `min-release-age-exclude` are exempt from this
401423
filter.
402424

‎deps/npm/docs/content/commands/npm-install.md‎
Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -410,8 +410,16 @@ Sets the strategy for installing packages in node_modules. hoisted
410410
(default): Install non-duplicated in top-level, and duplicated as necessary
411411
within directory structure. nested: (formerly --legacy-bundling) install in
412412
place, no hoisting. shallow (formerly --global-style) only install direct
413-
deps at top-level. linked: (experimental) install in node_modules/.store,
414-
link in place, unhoisted.
413+
deps at top-level. linked: install in node_modules/.store, link in place,
414+
unhoisted.
415+
416+
We recommend that package authors use `--install-strategy=linked` during
417+
development to catch undeclared ("phantom") dependencies before publishing:
418+
the isolated layout only exposes a package's declared dependencies, so an
419+
`import` of a package that was never added to `package.json` can fail
420+
instead of resolving by accident and shipping broken. See [Catching
421+
undeclared ("phantom")
422+
dependencies](/using-npm/developers#catching-undeclared-phantom-dependencies).
415423

416424

417425

@@ -670,6 +678,10 @@ silently skipped; this setting only affects unreviewed entries.
670678
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
671679
setting.
672680
681+
Optional dependencies that cannot be installed on the current platform or
682+
engine (a non-matching `os`, `cpu`, or `libc`) are not flagged, because
683+
their install scripts never run.
684+
673685
674686
675687
#### `dangerously-allow-all-scripts`
@@ -717,6 +729,10 @@ sources, the standard precedence applies (cli > env > project > user >
717729
global), so a higher-priority source can always relax or override a
718730
lower-priority one.
719731
732+
As with `min-release-age`, when this cutoff blocks a fix that `npm audit
733+
fix` would install, npm keeps the vulnerable version, warns, and exits with
734+
a non-zero code.
735+
720736
Packages whose names match `min-release-age-exclude` are exempt from this
721737
filter.
722738
@@ -739,6 +755,12 @@ your `.npmrc` is preserved when npm internally spawns a sub-process with
739755
apply, `before` wins within a single source and across sources the standard
740756
precedence rules apply.
741757
758+
When this window stops `npm audit fix` from installing a patched version
759+
(because the fix was published too recently), npm keeps the package at its
760+
vulnerable version, warns that the fix was blocked, and exits with a
761+
non-zero code. To install the fix, add the package to
762+
`min-release-age-exclude`, or relax `min-release-age` or `before`.
763+
742764
Packages whose names match `min-release-age-exclude` are exempt from this
743765
filter.
744766
0 commit comments
Comments
 (0)